Attackers exploit AhsayCBS flaws as latest version remains vulnerable

Attackers began exploiting two AhsayCBS backup software vulnerabilities on October 7 at 11:20 p.m. UTC, according to Huntress. The flaws can be chained to bypass authentication and execute commands remotely; five targeted organizations were estimated to have been affected as of October 8. Huntress observed web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. Although National Vulnerability Database advisories identify version 10.3.4 as fixed, Huntress says that version is also vulnerable. With no patch available, it recommends restricting the management interface to trusted IP addresses or requiring a VPN, and checking systems for signs of compromise.