Attackers are reportedly exploiting recently disclosed vulnerabilities in AhsayCBS backup software to compromise vulnerable systems, deploy web shells and install XMRig cryptocurrency miners disguised as Microsoft Edge processes. For businesses, the development is relevant because backup infrastructure often holds privileged access, sensitive data and a direct path into wider IT environments.

What happened

According to The Hacker News, threat actors have been observed targeting two recently disclosed flaws in AhsayCBS, a backup utility used by organisations and service providers. The reported activity includes taking control of affected devices and deploying web shells for persistent access, followed by XMRig cryptomining malware.

The source identifies one of the issues as CVE-2026-105133, described as an improper authentication vulnerability. Based on the report, attackers are using the flaws against exposed or unpatched installations to run unauthorised actions on the target system.

While cryptomining may appear less disruptive than ransomware, the presence of web shells and unauthorised remote access is a more serious concern. It can indicate that attackers have established persistence on a server that may also manage backup jobs, credentials or customer environments.

Why it matters for European businesses

Backup software is part of core operational infrastructure. If a backup server is compromised, the impact can extend beyond performance issues caused by cryptomining.

• Security risk beyond miners: Web shells can allow continued remote access, making the system a foothold for further compromise.
• Potential impact on recovery: If backup infrastructure is tampered with, organisations may face problems restoring systems after an incident.
• Credential exposure: Backup platforms may store administrative or system-level access needed to connect to servers, endpoints or cloud services.
• Operational disruption: Cryptomining can consume CPU and memory resources, degrading server performance and affecting backup operations.
• Service provider exposure: Managed service providers and hosting companies using multi-tenant backup tools may face broader downstream risk.

For European SMEs, this matters because backup systems are often maintained with less visibility than front-end business applications, yet they remain highly sensitive from both a cybersecurity and business continuity perspective.

Who may be affected

The risk is most relevant to organisations that use AhsayCBS directly, as well as IT providers managing backup environments for clients. This may include:

• SMEs running on-premise or self-managed backup infrastructure
• Managed service providers and digital agencies offering hosting or backup services
• IT teams responsible for backup, disaster recovery or infrastructure operations
• Companies with internet-exposed backup administration systems
• Organisations in regulated sectors where backup integrity is part of resilience and compliance expectations

Businesses that do not use AhsayCBS are unlikely to be directly affected by these specific vulnerabilities, but the incident is another reminder that backup and recovery tools should be treated as high-value attack surfaces.

What companies should consider

• Identify usage: Confirm whether your organisation or service providers use AhsayCBS in any environment.
• Review vendor guidance: Check for official security advisories, patches and mitigation steps from Ahsay, and verify whether affected versions are in use.
• Limit exposure: Restrict internet access to backup management interfaces wherever possible using VPNs, IP allowlisting or other access controls.
• Look for compromise indicators: Investigate unexpected processes, suspicious Microsoft Edge-named executables, unusual CPU usage, web shells and unexplained outbound connections.
• Audit privileged access: Review credentials, service accounts and connected systems accessible from the backup platform.
• Check backup integrity: Verify that backup jobs, retention policies and restore points have not been altered.
• Strengthen monitoring: Ensure backup servers are covered by logging, endpoint detection and alerting, not treated as isolated utility systems.

Where compromise is suspected, businesses should treat the issue as more than a performance problem caused by crypto miners. The reported use of web shells suggests the possibility of persistent access, and affected organisations may need full incident response steps including containment, credential rotation and forensic review.