Threat Overview
Huntress observed active exploitation of AhsayCBS Cloud Backup Server beginning October 7 at 23:20 UTC, targeting at least five organizations by October 8. Attackers chained CVE-2026-105133 (improper authentication) with CVE-2026-105134 (unauthenticated code execution through the Replication Receiver `/rps/api/json/UpdateReceivers.do` endpoint), producing SYSTEM-level command execution. Observed behavior includes `cbssvcX64.exe` spawning system utilities, JSP webshells, XMRig miner `edge.exe`, modified NSSM `msedge.exe` persistence through `MicrosoftEdgeUpdateSvc`, `Taskgmr.ps1` to hide mining when Task Manager opens, and WinRing0x64.sys driver installation in one incident. Critically, Huntress updated its findings October 8 to state that even AhsayCBS 10.3.4 is vulnerable, contradicting earlier version guidance. This threatens MSP backup-management infrastructure and potential customer recovery operations.
References
Impacted Systems
Vendor/product: Ahsay Systems AhsayCBS (Cloud Backup Server), management console and Replication Receiver API, self-hosted/MSP-operated backup server. Confirmed affected: releases up to and including 10.3.4 per Huntress October 8 update; earlier NVD/vendor-adjacent guidance that 10.3.4 was fixed is disputed. Fixed version: none confirmed as of October 10. Observed exploitation on Windows hosts, with execution as NT AUTHORITY\SYSTEM; other supported operating systems are not independently confirmed affected or unaffected. Prerequisite: attacker network reachability to the CBS management web service/API; no valid login required in observed chain. No universal port is asserted.
Why this matters
Backup management is high-value infrastructure for MSSPs; exploitation is confirmed, post-exploitation behavior is well documented, and a reliable patched release has not been established.
Exploitation Status
Confirmed exploitation (Huntress) beginning October 7. Five organizations targeted as of October 8. Successful command execution, webshell installation, miner activity and persistence observed. Exact global victim count unknown. Huntress explicitly reports 10.3.4 remains vulnerable.
What this hunt looks for
Layered behavioral and infrastructure searches covering: First pass — unexpected child processes of AhsayCBS service; Ahsay exploit path in web/proxy logs; JSP webshell and campaign payload file creation; Confirmed miner, payload hosting, and actor IP infrastructure; Masqueraded Edge binaries executed from temporary directories; MicrosoftEdgeUpdateSvc service persistence; PowerShell Task Manager suppression and service toggling; WinRing0 driver download or execution indicators; Process-to-network correlation for miner and Ahsay children.
Required logs
CommonSecurityLog, DeviceFileEvents, DeviceNetworkEvents, DeviceProcessEvents, Event, SecurityEvent
Hunt 1: First pass — unexpected child processes of AhsayCBS service
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("cbssvcX64.exe","cbssvcX86.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","curl.exe","certutil.exe","whoami.exe","net.exe","sc.exe","tasklist.exe") or ProcessCommandLine has_any ("Taskgmr.ps1","WinRing0x64","imagefiles-backup")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated descHunt 2: Ahsay exploit path in web/proxy logs
CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Url=tostring(column_ifexists("RequestURL","")), Extra=tostring(column_ifexists("AdditionalExtensions",""))
| where Url has "/rps/api/json/UpdateReceivers.do" or Extra has "/rps/api/json/UpdateReceivers.do"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, Url, DeviceAction, Extra
| order by TimeGenerated descHunt 3: JSP webshell and campaign payload file creation
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("Taskgmr.ps1","WinRing0x64.sys","config.json","edge.exe","msedge.exe") or FileName endswith ".jsp"
| where FolderPath has_any ("Temp","Ahsay","CBS","webapp") or InitiatingProcessFileName in~ ("cbssvcX64.exe","cbssvcX86.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated descHunt 4: Confirmed miner, payload hosting, and actor IP infrastructure
let IPs=dynamic(["177.4.12.11","38.60.252.110","107.191.47.199","185.220.236.49","104.234.26.10","123.202.208.37","51.195.127.124"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP in (IPs) or RemoteUrl has_any ("imagefiles-backup.oss-ap-southeast-7.aliyuncs.com","xmr.kryptex.network") or (RemotePort == 8029 and InitiatingProcessFileName in~ ("edge.exe","msedge.exe"))
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descHunt 5: Masqueraded Edge binaries executed from temporary directories
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("edge.exe","msedge.exe")
| where FolderPath has_any ("\\Temp\\","/Temp/","AppData") or ProcessCommandLine has "--daemonized"
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated descHunt 6: MicrosoftEdgeUpdateSvc service persistence
union isfuzzy=true
(SecurityEvent | where TimeGenerated >= ago(30d) and EventID == 4697 | extend Details=strcat(tostring(column_ifexists("ServiceName",""))," ",tostring(column_ifexists("ServiceFileName",""))," ",tostring(column_ifexists("EventData",""))) | project TimeGenerated, Computer, Details, Source="SecurityEvent 4697"),
(Event | where TimeGenerated >= ago(30d) and EventID == 7045 | extend Details=tostring(RenderedDescription) | project TimeGenerated, Computer, Details, Source="System Event 7045")
| where Details has "MicrosoftEdgeUpdateSvc" or (Details has "msedge.exe" and Details has "Temp")
| order by TimeGenerated descHunt 7: PowerShell Task Manager suppression and service toggling
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has "Taskgmr.ps1" or (ProcessCommandLine has "Taskmgr" and ProcessCommandLine has_any ("Stop-Service","Start-Service","MicrosoftEdgeUpdateSvc"))
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by TimeGenerated descHunt 8: WinRing0 driver download or execution indicators
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine has_any ("WinRing0x64.sys","imagefiles-backup.oss-ap-southeast-7.aliyuncs.com")
| where FileName in~ ("certutil.exe","curl.exe","powershell.exe","pwsh.exe","cmd.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by TimeGenerated descHunt 9: Process-to-network correlation for miner and Ahsay children
let Suspicious=DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("cbssvcX64.exe","cbssvcX86.exe") or (FileName in~ ("edge.exe","msedge.exe") and FolderPath has "Temp")
| project DeviceId, ProcessId, Started=TimeGenerated, FileName, FolderPath, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| join kind=inner Suspicious on DeviceId, $left.InitiatingProcessId == $right.ProcessId
| where TimeGenerated between (Started .. Started + 12h)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated descDetection Notes
- Highest signal: child processes from cbssvcX64.exe/cbssvcX86.exe, malicious service MicrosoftEdgeUpdateSvc, and published SHA256 hashes.
- Reported domain, IP, and mining port 8029 are campaign indicators, not universal indicators of every exploitation.
- Ahsay web request logs may be unavailable in CommonSecurityLog; WAF or reverse proxy data must contain the URI to detect the documented API.
- Legitimate Edge and WinRing0 activity may resemble individual filenames; location, lineage, and published hashes are essential.
- Windows 7045 events are in the Event table when ingested; SecurityEvent 4697 depends on service-install auditing.
