Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Huntress reports active exploitation of two chained vulnerabilities in AhsayCBS (CVE-2026-105133 authentication bypass and CVE-2026-105134 unauthenticated RCE) used to deploy JSP webshells and a cryptomining campaign. Attackers dropped a modified NSSM (msedge.exe), an XMRig miner (edge.exe), a PowerShell dropper (Taskgmr.ps1), and a vulnerable WinRing0x64.sys driver from Alibaba Cloud OSS, created a faux MicrosoftEdgeUpdateSvc service for persistence as SYSTEM, and connected miners to an XMR pool; the report includes IOCs, MITRE ATT&CK mappings, Sigma rules, and mitigation guidance.