Threat actors are actively exploiting unpatched flaws in the AhsayCBS backup management platform to deploy webshells and run cryptocurrency miners on victim servers.
Key points
- Huntress researchers identified active exploitation of two vulnerabilities in AhsayCBS.
- Attackers deploy webshells and disguised cryptocurrency miners on compromised servers.
- The affected platform is widely used by managed service providers for backup management.
Threat actors are actively exploiting unpatched vulnerabilities in the AhsayCBS backup management platform. These attacks allow adversaries to deploy webshells and run cryptocurrency miners on compromised servers, according to security researchers.
What happened
Huntress researchers reported that attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS. This software serves as the management console for Ahsay’s cloud backup solutions. The attackers use these flaws to take over servers and quietly run cryptocurrency miners.
BleepingComputer noted that the threat actors are targeting one critical and one medium-severity vulnerability. Both of these security flaws remain unpatched in the AhsayCBS platform. The attackers leverage these issues to deploy webshells on the affected systems. This gives them persistent access to the network and the ability to execute commands.
The exploitation involves disguising the cryptocurrency miners to avoid detection by standard monitoring tools. This allows the malicious processes to run silently in the background. The attackers aim to harvest computing resources for financial gain without alerting administrators.
Why it matters
AhsayCBS is primarily used by managed service providers and system integrators. These organizations use the platform to create users and manage backup policies for their clients. A compromise of this central management console can impact multiple downstream clients.
The deployment of webshells provides attackers with a foothold in the environment. This access can be used to pivot to other systems or exfiltrate sensitive data. The presence of cryptocurrency miners also consumes significant system resources, leading to performance degradation.
The fix
- Monitor server logs for unusual process activity or unexpected network connections.
- Scan systems for known webshell signatures and unauthorized scripts.
- Restrict access to the AhsayCBS management console to authorized personnel only.
- Isolate affected servers immediately if compromise is suspected.
What to do and how to stay safe: AhsayCBS
- Review server resource usage for spikes that may indicate hidden cryptocurrency mining.
- Check for unauthorized webshell files in web directories and temporary folders.
- Verify that all administrative accounts have strong, unique passwords enabled.
- Monitor outbound network traffic for connections to known malicious domains.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is AhsayCBS?
AhsayCBS is the management console for Ahsay’s cloud backup software, mainly used by managed service providers to manage backup policies.
What are attackers deploying on these servers?
Attackers are deploying webshells and disguised cryptocurrency miners on compromised AhsayCBS servers.
Are there patches available for these vulnerabilities?
No, the source material states that the critical and medium-severity vulnerabilities remain unpatched.
