Loading story…
Threat actors are exploiting two critical vulnerabilities, CVE-2026-105133 and CVE-2026-105134, in internet-exposed AhsayCBS backup management servers to bypass authentication and execute code as NT AUTHORITY/SYSTEM. Huntress observed exploitation beginning October 7, 2026, at 23:20:15 UTC, followed by JSP webshell deployment and cryptocurrency mining. Attackers disguised the XMRig miner as edge.exe and a modified NSSM service-management utility as msedge.exe, establishing persistence through a deceptive Windows service.
A PowerShell script concealed mining activity while Task Manager was open, and a vulnerable WinRing0 driver gave the miner kernel-level hardware access. AhsayCBS version 10.3.4 mitigates both vulnerabilities. Huntress recommends immediate upgrades, restricting access to management interfaces, and re-imaging compromised hosts from trusted backups. The company also published four campaign-specific Sigma detection rules to help defenders identify the activity.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Huntress first observed exploitation at 23:20:15 UTC, detecting suspicious commands spawned by cbssvcX64.exe. Attackers chained CVE-2026-105133 for authentication bypass with CVE-2026-105134 to execute code.
CVE-2026-105133 and CVE-2026-105134 were identified in AhsayCBS versions up to 10.3.2. The flaws permit improper authentication and unauthenticated remote code execution through the Replication Receiver endpoint with NT AUTHORITY/SYSTEM privileges.
AhsayCBS version 10.3.4 was released with mitigations for vulnerabilities later identified as CVE-2026-105133 and CVE-2026-105134.
Huntress published four post-exploitation Sigma rules covering suspicious AhsayCBS child processes, disguised Edge binaries, Task Manager-aware service control, and WinRing0 downloads. Its report also supplied campaign indicators and recommended upgrading vulnerable installations and re-imaging compromised hosts from trusted backups.
The NVD records for CVE-2026-105133 and CVE-2026-105134 state that an exploit was published. The source does not specify when publication occurred.
In one incident, attackers used certutil.exe to download WinRing0x64.sys into a user's temporary directory. Huntress assessed that the driver was loaded to provide kernel-level hardware access and improve mining performance, rather than disable endpoint security tools.
Attackers deployed Taskgmr.ps1 to stop the mining service when Task Manager opened and restart it when Task Manager closed. The script also terminated Task Manager at specified local times or after prolonged overnight use.
Attackers downloaded XMRig as edge.exe and a modified NSSM utility as msedge.exe from Alibaba Cloud Object Storage. They created MicrosoftEdgeUpdateSvc to run with SYSTEM privileges and maintain the miner, which connected to Kryptex mining infrastructure.
Attackers configured malicious replication receivers and deployed JSP webshells into the web application directory served by compromised AhsayCBS installations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
The **Kingminer** botnet has been repeatedly observed compromising publicly exposed **Microsoft SQL Server** instances by brute-forcing weak credentials on TCP port `1433`, then deploying cryptocurrency miners and follow-on tooling. Researchers linked these intrusions to opportunistic campaigns that install customized **XMRig** miners, use downloader scripts and fileless **PowerShell** execution, and in some cases deliver **Cobalt Strike** beacons for persistence and post-compromise control. Investigations also found payload staging through **GitHub**, abuse of legitimate Windows binaries including `MSBuild.exe`, `rundll32.exe`, `control.exe`, and `main.cpl`, and injection into trusted processes such as `wwanmm.dll` to reduce detection. Threat reports describe Kingminer as a moderately sophisticated criminal botnet that combines public offensive tools with custom malware components, including reflective loading, DLL side-loading, and credential theft capabilities derived from tools such as **Mimikatz**. In one investigated intrusion, `sqlservr.exe` launched an obfuscated VBScript that downloaded a standalone PowerShell binary and executed additional scripts in memory before starting a miner. The malware also checked systems for **BlueKeep**-related hotfixes `KB4499175` and `KB4500331` and disabled **RDP** on vulnerable hosts, apparently to block competing botnets from exploiting the same machines. Defenders were advised to enforce strong SQL passwords, restrict internet exposure, patch public-facing services, and improve logging and monitoring, as repeated attack attempts stopped once the underlying weakness was remediated.
Aug 14, 2026