Vulnerability
The fake Edge on an Ahsay backup server
Attackers are chaining two AhsayCBS vulnerabilities to run miners on backup servers. Version 10.3.4.0, previously listed as fixed, remains affected, and Ahsay now requires a new hotfix. The new repair targets the authentication bypass, while previously compromised hosts also need investigation and web-shell removal.
In this article
Open Task Manager and the miner stops. Close the window and it starts again. A PowerShell script found by Huntress in these AhsayCBS intrusions watched that window and changed a service's state accordingly. The programs pretending to be Edge lived in a temporary directory. The process launching their downloads belonged to the backup service.
AhsayCBS manages backup users, policies and replication jobs, often for managed service providers and systems integrators. Such a server runs for long periods and holds configuration needed to restore business operations. In this campaign, attackers used its execution privileges to install miners and web shells. High CPU use is the visible symptom. Whether the backup control server can still be trusted is the question that follows.
As of October 13, Ahsay's current instruction is to apply hotfix 10.3.4.45 to v10 and follow its supported path to 9.15.2.70 for v7, v8 and v9, then reboot. The earlier 10.3.4.0 and 9.15.2.59 patches did not fully address the two vulnerabilities. Restrict external access to management first, then apply the repair appropriate to the installed base version. A host with evidence of earlier intrusion also needs investigation and recovery.
1 “Already updated” changed meaning within days
The version boundary is unusually easy to misread. Both CVE records published on October 4 named 10.3.4 as the fixed release. Huntress began observing exploitation at 23:20:15 UTC on October 7 and subsequently confirmed that 10.3.4 was affected too. Ahsay's October 9 clarification still said 10.3.4.0 protected against unauthenticated remote exploitation. Its October 10 alert acknowledged the incomplete repair and directed v10 users to a new hotfix. The October 12 update added the older-branch path.
At this review, the NVD authentication record and code-execution record still carried the old recommendation to upgrade to 10.3.4, with their last modification dated October 6. An inventory keyed only to that description could exclude a still-vulnerable release from its repair queue. Use the October 12 vendor advisory for the current action and retain the full four-part version. Abbreviating 10.3.4.45 to 10.3.4 loses the distinction that matters.
Huntress's October 12 update says it independently verified that 10.3.4.45 blocks the chain's initial authentication bypass. That supports prompt deployment. The package requires a partner login, and a complete patch diff is absent from the public advisory. Its individual file-writing branches therefore cannot be described from the available patch evidence. A web shell already placed in the application directory remains an intrusion artifact to handle separately.
2 A value on a public page bypassed credential checks
CVE-2026-105133 concerns API authentication. In Armadin's published decompilation, the relevant function is checkSysPwd() in com/ahsay/obs/api/ApiStructsAction.java, inside cbs.jar. Alongside the system-user and password check, it contains a branch that returns early.
When the function encounters an exception reading SysUser or SysPwd from the request JSON, that branch compares the request's Random value with the server's RANDOM_UI_STR. Equality causes an immediate return before normal credential validation. The server generates the value in a static initializer at class loading, and it remains unchanged for that application process's lifetime.
The random generator did not establish an identity here. The unauthenticated /cbs/mfa/mfa.jsp page embedded the same value in its JavaScript response. The server disclosed a value to visitors and also accepted possession of it as a reason to skip credentials. Someone who fetched the page could consequently enter that API path. Armadin's records include a rejected unauthenticated request and successful account creation after supplying the disclosed value.
A restart generates a fresh process-level value, which the public page can disclose again. Restarting alone therefore leaves this design in place. Stronger passwords or MFA on the ordinary login path likewise leave the early-return branch untouched. Closing the path around normal authentication is what makes the hotfix important.
3 The replication destination became a code destination
After bypassing authentication, an attacker can alter replication-receiver configuration. CVE-2026-105134 involves /rps/api/json/UpdateReceivers.do. A receiver writes files sent by another server, with SystemHome selecting their destination. In its test, Armadin pointed the setting at webapps/cbs beneath the installation directory, the live CBS web application, and used the file-synchronization interface /rps/obs7/rpsfile/upload to place a JSP there.
After the management-API configuration change, the file-synchronization request still carried its own username and authentication fields. Some credentials are redacted, and the complete synchronization authentication implementation is unavailable. After uploading, the researcher requested the JSP. A JSP contains server-side web code, which can run when placed in an executable application location. The Windows test returned NT AUTHORITY\SYSTEM, connecting the file write to code execution with the service's identity. An ordinary backup file in a data directory has no corresponding web-execution step.
This explains why Huntress noticed unexpected children of cbssvcX64.exe. CBS hosts its Tomcat web application inside the service process, so commands launched through an uploaded JSP appear as its children. The parent belongs to the backup product. The child's activity can already be outside the backup job.
Two capabilities can be constrained separately: permission to change a receiver and the locations where that receiver may write. Public verification of the new v10 hotfix establishes a block at the initial authentication entry. A durable design should also separate replication storage from executable web directories and restrict writes to their backup purpose. Implementing it requires a supported product configuration, not moving production directories arbitrarily.
4 How the fake Edge stayed on the host
In several intrusions observed by Huntress, edge.exe was XMRig, consuming the host's CPU to mine Monero for its operator. msedge.exe was a modified NSSM service utility. The files were placed in temporary directories and a service named MicrosoftEdgeUpdateSvc ran with SYSTEM privileges. NSSM can run another program as a service and restart it after it exits. Huntress assesses that the attackers likely used those capabilities to keep the miner running. Familiar browser names supplied the disguise, with persistence established through a Windows service.
Taskgmr.ps1 concealed that activity by stopping the mining service while Task Manager was open and starting it again after the window closed. It also terminated Task Manager at 18:00 local host time or when the window remained open for more than an hour overnight. CPU use falling when Task Manager opens can therefore be the script responding. In one incident, Huntress also saw WinRing0x64.sys downloaded for low-level hardware access by the miner. The driver has legitimate uses, so its presence alone cannot identify this chain.
The investigation needs to connect files, parent-child processes, service configuration and time. Edge-named files in Temp, a service pointing to them and downloads launched by the backup process are more specific than the presence of a browser process. Huntress had seen five organizations targeted as of October 8. That is its observation boundary, not a count of all affected Ahsay users.
Its four pinned Sigma rules examine unexpected service children, fake-Edge characteristics, Task Manager-aware service control and WinRing0 downloads containing a URL. The PowerShell rule looks for taskmgr, Stop-Service and Start-Service in one script block. Those actions remain interesting if the service is renamed.
The unexpected-child rule excludes several product child processes and uses anchored regular expressions for common startup, maintenance and backup commands. A startup probe followed by another command no longer matches that startup exception. Replacing this with a broad allowance for the backup service to launch a command interpreter would excuse activity that needs investigation. These rules are marked experimental. Check that telemetry contains the required parent-process, command-line and script-block fields, then test local normal jobs for false positives.
5 Repair the entry, then establish whether the server is trustworthy
Keep management access behind trusted addresses or a VPN while checking that backup-client and replication traffic still works. Ahsay's general hotfix guide requires the correct base release, no active jobs, stopping CBS and its NFS service, overwriting the relevant files in the package paths, and checking the full product version afterward. The current security alert also requires a reboot. The October 12 advisory directs v7, v8 and v9 users to the v9 hotfix entry, while the general guide requires a matching base release. Users of older versions should have support confirm the applicable package and prerequisites for their installation, without copying v9 files onto an arbitrary older instance.
After installation, check the running instance's complete version and startup logs, then exercise backup, replication and restore. Preserved configuration and program copies can support recovery from a failed upgrade. An affected old program may be used only with access isolated during that emergency. It is not a repaired public-facing rollback target. Shutdown and restart interrupt work, so let active jobs finish before the maintenance begins.
A web shell, anomalous service or corresponding execution record calls for a different response. Preserve logs, files and service details, establish the earliest visible activity, and rebuild affected hosts from trusted sources. Huntress likewise recommends full host re-imaging when this campaign's indicators are found because additional backdoors may remain. Review the software and configuration being restored. A recovery point predating the first known malicious file is not sufficient on its own to establish trust.
Restore verified data in the isolated rebuilt environment, check access permissions and the business result, then let the new control server take over backup jobs. Both the recovered content and the server responsible for recovery need to stand up to that check.