tag: Backup-Software · 3 items
- Engineer — Act: Both CVEs are CISA KEV-listed with public PoCs and confirmed active exploitation deploying web shells and XMRig miners; update AhsayCBS to the latest patched release immediately and audit backup servers for existing web shell artifacts in the application directories.
- SOC/IR — Act: Active exploitation is dropping web shells and XMRig miners on AhsayCBS hosts — hunt for unexpected files in backup application directories, anomalous outbound connections to mining pools, and lateral movement from backup server accounts since the initial disclosure date.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub · CVE-2026-105134 — CISA KEV: listed, EPSS 0.03, public PoC on GitHub
- Engineer — Act: No patch exists yet for these critical AhsayCBS flaws, so the immediate action is to audit whether AhsayCBS backup servers are in your environment and, if so, isolate or restrict network access to them while implementing compensating controls until a vendor patch is released.
- SOC/IR — Act: Active exploitation is deploying webshells on AhsayCBS servers — sweep backup infrastructure for webshell artifacts and anomalous outbound connections indicative of a crypto miner; treat any AhsayCBS host as potentially compromised until cleared.
- Leader — Plan: AhsayCBS is niche backup management software, so confirm whether it is in your environment this quarter; if it is, escalate to engineer/SOC as an active unpatched exposure in backup infrastructure, which is a high-value target for ransomware precursors.
- Engineer — Act: Active exploitation of AhsayCBS is confirmed with web shell and XMRig miner deployment, and a public PoC is available on GitHub. Patch AhsayCBS immediately and audit any instances for web shell artifacts and unauthorized processes on affected hosts.
- SOC/IR — Act: Attackers are actively deploying web shells and XMRig miners disguised as Microsoft Edge on compromised AhsayCBS hosts — hunt for msedge.exe processes running from unexpected directories and sweep backup server hosts for web shell indicators since the public PoC dropped.
- Leader — Skip
- Signals: CVE-2026-105133 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub