Hackers turn business backup servers into crypto mines after sneaking malware disguised as Microsoft Edge
At least five organizations were targeted by the malware in just a few days.
Hackers have been secretly using business backup servers to mine cryptocurrency, after infiltrating the servers with malware disguised as Microsoft Edge. The attack exploited critical vulnerabilities in the Ahsay Cloud Backup Suite (AhsayCBS), a widely-used backup management platform developed by a Hong Kong-based company. On October 4, 2026, two flaws were publicly disclosed: CVE-2026-105113, a medium-severity vulnerability affecting the checkSysPwd function, and CVE-2026-105134, a critical-severity flaw allowing unauthenticated remote code execution.
By exploiting these bugs, threat actors were able to bypass authentication, gain code execution, and deploy malicious webshells disguised as Microsoft Edge processes. The attackers hid their activities by installing XMRig, a cryptocurrency miner, as a fake Edge update service and shutting down the miner when Task Manager is opened.
As of October 8, at least five organizations had already been targeted, underscoring the urgency for businesses using AhsayCBS to apply the provided patch immediately and restrict access to the backup server.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
