Cybercriminals are leveraging an Alibaba Cloud storage endpoint to deliver a suite of post-exploitation tools and Java Server Page webshells to target systems. The inherent trust placed in backup solutions often creates a dangerous blind spot for cybersecurity teams who assume these systems are inherently secure against external manipulation, making platforms like Ahsay Cloud Backup Server (AhsayCBS) a prime target. Since early October 2026, threat actors have moved aggressively to exploit architectural weaknesses in this infrastructure, which is a staple for managed service providers worldwide. The primary objective of this current campaign is the installation of XMRig cryptocurrency miners, which are meticulously hidden to avoid raising red flags during routine system audits. By focusing on resource exploitation rather than data destruction, the attackers maintain a quiet presence while generating Monero for their coffers. This strategy shifts the focus from immediate disruption to long-term resource theft, presenting a unique challenge for IT administrators.
The Mechanics of Vulnerability Exploitation
Technical Analysis of the Authentication Bypass
The technical core of this attack is defined by a sophisticated chain of two distinct security flaws, identified as CVE-2026-105133 and CVE-2026-105134, which together grant attackers unrestricted access. The first vulnerability is a medium-severity authentication bypass located within the password check function of the backup system, allowing an actor to sidestep the initial gatekeeper. Once inside, they exploit the second flaw, a critical remote command injection vulnerability found in the Replication Receiver endpoint. This combination enables the execution of arbitrary code with the highest possible Windows privileges, known as NT AUTHORITY\SYSTEM. By operating at this level, the attackers can manipulate system drivers, modify registry keys, and install persistent services without triggering standard user-level alerts. This vulnerability chain highlights the risk of relying on single-factor authentication for management interfaces that handle sensitive server operations and customer data.
Exploiting Versioning Discrepancies in Backup Software
One of the most alarming aspects of this campaign is the false sense of security provided by inaccurate vulnerability reporting in some public databases. While several security advisories suggested that updating to version 10.3.4 would resolve the critical command injection flaws, recent analysis has confirmed that this version remains vulnerable to the current exploit. Organizations that believed they had patched their systems based on these reports are finding themselves compromised despite their proactive efforts. This discrepancy underscores the necessity of verifying vendor-supplied patches through independent security audits and direct testing rather than relying solely on third-party tracking services. The gap between a reported patch and its actual effectiveness has allowed threat actors to continue their operations against targets that assumed they were safe. This situation creates a unique challenge for administrators who must now decide whether to wait for a verified update or implement immediate network-level mitigations.
Strategic Evasion and Post-Exploitation Tactics
Persistence Through Masquerading and Fake Services
To maintain control over the compromised servers, the attackers utilize a combination of persistent webshells and legitimate Windows utility tools to hide their tracks. After establishing an initial foothold, they deploy Java Server Page (JSP) webshells that provide a back-door connection independent of the original vulnerability. To ensure the XMRig miner remains operational, they utilize a modified version of the Non-Sucking Service Manager (NSSM), which they have renamed to “msedge.exe” to mimic the Microsoft Edge browser. The miner itself is frequently renamed “edge.exe” and registered as a persistent Windows service under the deceptive name “MicrosoftEdgeUpdateSvc.” This naming convention is designed to bypass the scrutiny of IT staff who might see the process in a service list and assume it is a standard background update. Furthermore, the use of legitimate drivers like WinRing0x64.sys allows the malware to gain direct hardware access, optimizing mining performance while remaining hidden.
Advanced Detection Evasion and System Recovery
The complexity of this campaign reached a peak with the deployment of a specialized PowerShell script named Taskgmr.ps1, which actively monitored the host for user activity. If a system administrator opened the Windows Task Manager to investigate performance issues, the script immediately terminated the mining process to hide the sudden spike in CPU usage. Only after the monitoring tool was closed did the script allow the mining activities to resume, effectively evading detection during manual inspections. Because the exploit granted full system control, the safest path forward involved a complete system rebuild from trusted backups rather than attempting to surgically remove the malware components. Security researchers concluded that moving management interfaces behind a robust VPN or restricting access to trusted IP addresses served as the most effective preventative measure. These steps, combined with rigorous monitoring of outbound traffic, provided a framework for mitigating the risks of exposed backup servers.
