Attackers are exploiting two vulnerabilities in AhsayCBS backup-management software to deploy web shells and XMRig cryptocurrency miners, according to reporting published October 9. Huntress said version 10.3.4 remains vulnerable, making asset identification and containment especially important for organizations that run the product.
What defenders should do
Locate all AhsayCBS instances, restrict public exposure, apply vendor guidance when available, and hunt for unexpected web shells, altered services, and miner activity. Backup-management systems deserve heightened attention because they can offer access to recovery operations and sensitive data.
Source: The Hacker News.