Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

Threat actors are actively exploiting unpatched vulnerabilities in the AhsayCBS backup management platform. The attack chain involves one critical and one medium-severity vulnerability that remain unpatched. Exploitation leads to the deployment of webshells, granting persistent remote access to compromised systems. Attackers also deploy cryptocurrency miners on affected infrastructure. The vulnerabilities target the backup management platform, which is typically deployed in enterprise environments. No patches are currently available, making all users of the platform potentially vulnerable. The active exploitation in the wild elevates the urgency for mitigations or workarounds.