Date: 10/12/2026
Severity: High
Summary
On October 4, 2026, two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were disclosed in the AhsayCBS backup utility. From October 7, Team observed attackers exploiting these flaws for remote code execution, targeting five organizations by October 8. Following exploitation, attackers conducted reconnaissance, deployed webshells, and installed XMRig cryptominers disguised as Microsoft Edge. They also deployed a suspected AI-assisted PowerShell script that monitors Windows Task Manager and closes it if it remains open too long during nighttime hours. AhsayCBS versions 10.3.4 and earlier are affected, making prompt patching and investigation of compromised systems essential.
Indicators of Compromise (IOC) List
Domains/URLs | http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1 http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys xmr.kryptex.network:8029 |
IP Address | 177.4.12.11 38.60.252.110 107.191.47.199 185.220.236.49 104.234.26.10 123.202.208.37 |
Hash | 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034
4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d
481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe" or url like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe" or siteurl like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/msedge.exe" or domainname like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys" or url like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys" or siteurl like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/WinRing0x64.sys" or domainname like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe" or url like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe" or siteurl like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/edge.exe" or domainname like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1" or url like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1" or siteurl like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/Taskgmr.ps1" or domainname like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json" or url like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json" or siteurl like "http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com/javas/Office/win/config.json" or domainname like "xmr.kryptex.network:8029" or url like "xmr.kryptex.network:8029" or siteurl like "xmr.kryptex.network:8029" |
Detection Query 2 : | dstipaddress IN ("185.220.236.49","104.234.26.10","107.191.47.199","123.202.208.37","177.4.12.11","38.60.252.110") or srcipaddress IN ("185.220.236.49","104.234.26.10","107.191.47.199","123.202.208.37","177.4.12.11","38.60.252.110") |
Detection Query 3 : | sha256hash IN ("05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034","481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21","4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d")
|
Reference:
Threat Actors Exploit Critical AhsayCBS Flaws