Cybercriminals Hijack AhsayCBS Backups to Install XMRig Miners Masquerading as Edge

Security researchers have identified a new campaign in which threat actors target the AhsayCBS backup platform, exploiting two recently disclosed vulnerabilities to gain footholds on victim machines and install Monero‑mining software that pretends to be Microsoft Edge.

The attack hinges on CVE‑2026‑105133, assigned a CVSS v4 score of 5.5, which is described as an improper handling flaw that allows unauthenticated users to execute arbitrary commands on the backup server. A second, less‑publicized weakness in the same product enables the insertion of malicious web shells after initial access is achieved.

Once the vulnerabilities are leveraged, the intruders upload a lightweight web shell, establishing a persistent backdoor. Through this channel they download and launch XMRig, an open‑source Monero miner. To avoid detection, the miner’s executable is renamed and bundled with resources that mimic the appearance of the Microsoft Edge browser, tricking both users and basic security tools.

Running a cryptocurrency miner on a backup server can have immediate operational consequences. Administrators may notice degraded backup performance, elevated CPU usage, and unexplained network traffic. Over time, the hidden mining process can increase electricity costs and, more critically, expose the compromised system to further manipulation or data exfiltration.

The incident underscores a broader trend in which attackers weaponize legitimate infrastructure components. Backup solutions are trusted by enterprises to safeguard critical data, making them attractive targets for supply‑chain‑style abuse. Similar tactics have been observed in recent years, where compromised utilities become launchpads for ransomware, cryptojacking, or espionage activities.

The vendor has issued patches for the identified flaws and recommends that all AhsayCBS installations be updated without delay. Security teams are advised to audit their backup environments for unknown web shells, monitor for anomalous process activity, and enforce strict network segmentation for backup traffic. As defenders scramble to remediate, analysts expect additional variants of the technique to surface, highlighting the need for continuous vulnerability management and threat‑intel sharing across the industry.