Latest / The Digital Warfare Podcast / EP. 178: AhsayCBS Vulnerabilities Exploited to Deploy Webshells and Crypto Miners
Transcript
- Digital Warfare: Welcome to the Digital Warfare Daily Brief. Today, we're looking at an active exploitation campaign targeting assay CBS backup management servers, where attackers are chaining two vulnerabilities to bypass authentication, execute operating system commands, deploy web shells, and install cryptocurrency miners. The vulnerabilities are tracked as CVE-2026-105133 and CVE-2026-105134. CVE-2026-105133 is an authentication bypass vulnerability. Attackers are using it as the initial entry point, allowing them to reach functionality that should normally require valid credentials. The second vulnerability CVE-2026-105134 allows operating system command injection. When chained together, the attack path becomes significantly more serious. The attacker first bypasses authentication and then uses the command injection vulnerability to execute commands directly on the underlying server. This effectively turns a web-facing backup management platform into a remote execution pathway. Observed attacks began with reconnaissance after exploitation. Attackers then deployed Java Server Page or JSP web shells onto compromised systems. A web shell gives an attacker persistent remote access through the web server and can be used to execute commands, transfer additional payloads, collect information, and maintain access even after the initial exploit path has been identified. Researchers also observed attackers downloading the XM rig. Cryptocurrency miner. The miner was disguised as a file named Edge.exe, making it appear associated with Microsoft Edge. Persistence was established using a service named Microsoft Edge Update SVC. That service executed a file called msedge.exe, which researchers identified as a modified copy of the legitimate NSSM service management utility. The attackers also used a PowerShell script named TaskGMR.ps1. That script attempted to conceal the mining operation by monitoring Task Manager. When Task Manager was opened, the malicious mining service stopped. When Task Manager was closed, the service restarted. The script could also terminate Task Manager under specific conditions, making manual investigation more difficult. In at least one compromised environment, Attackers deployed the vulnerable WinRing OX64.sys driver. That driver can provide low-level hardware access and may have been introduced to increase the resources available to the cryptocurrency miner. The issue is particularly important because Assay CBS is commonly used by managed service providers and system integrators. A vulnerable backup management server can therefore occupy a highly trusted position within an organization's infrastructure. Backup platforms frequently hold credentials, administrative access, protected data sets, and connections to multiple systems. Compromise of this type of platform should never be treated as a simple crypto mining incident. The presence of a miner may be the most visible indicator, but a web shell or other persistence mechanism can provide attackers with continued access long after the mining process has been removed. Another significant concern is. Hatch status. The vulnerabilities were previously reported as fixed in Assay CBS version 10.3.2. However, subsequent investigation found that version 10.3.4, which was the latest version at the time of reporting, remained affected. That means administrators should not assume that simply running the newest available release eliminates exposure. Until a complete vendor fix is available, organizations should restrict access to the Assay CBS management interface so that only trusted IP addresses can reach it. Security teams should also investigate systems for JSP web shells, unexpected services, suspicious PowerShell activity, XM rig processes, and the presence of the Winring Zero driver. If compromise is confirmed, simply deleting the miner is not enough. The server should be treated as potentially fully compromised because attackers may have installed additional persistence mechanisms or backdoors. This incident demonstrates why internet-facing administrative and backup infrastructure deserves the same level of protection as identity systems, VPN gateways, and domain controllers. When authentication bypass and command execution vulnerabilities can be chained together, Defenders should assume that exploitation can move rapidly from initial access to complete server control. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you next time.