Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto
BLUF
Active exploitation of unpatched AhsayCBS vulnerabilities is compromising backup servers for webshell access and crypto mining.
NEWS
Threat actors are leveraging a critical and a medium-severity flaw in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. These vulnerabilities remain unpatched, allowing attackers to gain unauthorized access to affected systems. Reports indicate ongoing campaigns targeting users of this specific backup software.
Why I Care
Backup servers are high-value targets for ransomware and data theft; compromise here can lead to loss of recovery capabilities and financial damage from crypto mining or further lateral movement. Any organization running AhsayCBS is at immediate risk of system takeover.
Next Steps
Administrators should apply the latest vendor patches immediately if available, or isolate affected systems from the network until remediation is possible. Security teams should scan for indicators of compromise related to webshells and mining processes on all AhsayCBS instances.
Source: BleepingComputer ·