Hackers turn business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge

Attackers exploited critical AhsayCBS backup software flaws to compromise organizations’ backup servers Intrusions deployed webshells and disguised XMRig cryptominers for persistence and stealth Researchers urge immediate patching, restricted access, and full system reimaging if compromised In a particularly brazen hack, threat actors were seen targeting the servers that businesses use as backups in case of a cyberattack.

The vulnerabilities used in this attack have since been mitigated, but since the attack is currently ongoing, organizations using this particular backup method are urged to apply the fixes immediately and secure their premises.

AhsayCBS backup utility At the core of this incident is a backup utility called Ahsay Cloud Backup Suite (or AhsayCBS), a server-based backup management platform developed by a company of the same name, based in Hong Kong.

Businesses, managed service providers (MSP), and IT admins use it to manage backups for their devices and clients across a range of virtual and physical servers, databases, and various software environments, with the tool widely used by IT service providers to manage their clients' data.

Security researchers Huntress noted that on October 4, 2026, two flaws in AhsayCBS were publicly disclosed: CVE-2026-105113, and CVE-2026-105134.

The former is a medium-severity vulnerability affecting the checkSysPwd function, and can lead to improper authentication.

The latter is a critical-severity flaw affecting the Replication Receiver component, which could lead to unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host.

“The API contains an authentication bypass that could allow for a random token to substitute valid credentials,” the researchers explained.

“After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory served by the CBS application.” Just three days later, threat actors started exploiting these bugs - the first one to bypass authentication, and the second one to gain code execution and deploy webshells on exposed systems.

The webshells served primarily as droppers, deploying a range of stage-two executables .

Mining crypto Huntress also saw threat actors deploy a popular cryptominer called XMRig.

This is a legitimate open-source miner that uses the computer’s hardware, electricity, and internet, to mine the Monero currency and deposit it to the attackers’ wallets .

Monero is the go-to currency for unsolicited crypto mining since it is designed as a privacy-first coin that is very difficult to trace across the blockchain.

The attackers went to lengths to hide XMRig on these backup servers.