Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

What it is

Active exploitation campaign against AhsayCBS chaining CVE-2026-105133 (checkSysPwd auth bypass) and CVE-2026-105134 (unauthenticated RCE via /rps/api/json/UpdateReceivers.do) to deploy JSP webshells, a renamed XMRig cryptominer, and the vulnerable WinRing0x64.sys kernel driver. Huntress first observed exploitation starting 2026-10-07 23:20:15 UTC.

How it works

After the auth-bypass/RCE chain, cbssvcX64.exe (the AhsayCBS service process) spawns malicious child processes — either dropping a JSP webshell directly, or running curl/certutil commands that pull additional payloads from imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com into %TEMP%: Taskgmr.ps1, msedge.exe, edge.exe, and config.json.

edge.exe is XMRig itself, renamed to impersonate Microsoft Edge and connecting to an XMR pool at 51.195.127[.]124:8029 (xmr.kryptex[.]network). msedge.exe is a modified copy of the legitimate NSSM utility, used to create a persistence service named MicrosoftEdgeUpdateSvc (mimicking the real edgeupdate service) that runs edge.exe from Temp with SYSTEM privileges.

Taskgmr.ps1 is an AI-assisted anti-detection script: it polls for Task Manager and stops MicrosoftEdgeUpdateSvc whenever Task Manager is open, restarting it when Task Manager closes. It also kills Task Manager outright at 18:00 local time, or if left open more than an hour overnight — using the endpoint's local clock, not UTC.

Separately, attackers used certutil.exe to download WinRing0x64.sys (from OpenLibSys) to Temp. Unlike typical "bring your own vulnerable driver" EDR-killing abuse, here the driver is loaded to give the miner kernel-level hardware access for better mining performance.

Preconditions / Affected

AhsayCBS versions through 10.3.4 are affected — Huntress's update (2026-10-08) corrects earlier reporting that had excluded 10.3.4. CVE-2026-105134 requires the Replication Receiver's UpdateReceivers.do endpoint to be externally reachable; no authentication is needed since the token check can be bypassed.

What to do

• Restrict access to the AhsayCBS management interface to trusted IPs or require VPN — the exploited endpoint is the externally accessible web app service.
• If any listed IOCs (domain, pool IP, filenames, service name MicrosoftEdgeUpdateSvc) are found on a host, perform a full re-image from a trusted backup rather than just removing the malware, since attackers have planted secondary backdoors for extended persistence.
• No patch is available yet; Huntress has notified Ahsay.
• Four Sigma rules are published in Huntress's threat-intel repo (2026/2026-10/AhsayCBS_XMRig_Miner), each targeting one stage: unexpected child processes from cbssvcX64.exe/cbssvcX86.exe; Edge-named binaries carrying the msedge_exe original filename or run with --daemonized; PowerShell scriptblocks that pair a Task Manager check with starting/stopping a service (catches Taskgmr.ps1-style logic even if renamed); and command lines referencing WinRing0 alongside a download URL.

flowchart TD
    A[CVE-2026-105133 auth bypass] --> B[CVE-2026-105134 RCE as SYSTEM]
    B --> C[JSP webshell dropped]
    B --> D[curl/certutil fetch payloads]
    D --> E[edge.exe = XMRig miner]
    D --> F[msedge.exe = modified NSSM]
    D --> G[Taskgmr.ps1 anti-detection]
    D --> H[WinRing0x64.sys kernel driver]
    F --> I[MicrosoftEdgeUpdateSvc persistence]
    I --> E
    G -->|Task Manager open| J[Stop mining service]
    G -->|Task Manager closed| I
    H --> K[Kernel-level hardware access for miner]

Caveats

The vulnerable-driver technique is normally used to blind EDR, but Huntress states this instance appears aimed only at hardware access for mining performance, not security-tool evasion.