Threat Actors Exploit Two AhsayCBS Zero-Days to Compromise Backup Servers
Attackers are using two unpatched flaws in Ahsay Cloud Backup Server to gain SYSTEM-level access and deploy malicious software on exposed infrastructure.
Key points
- Two zero-day vulnerabilities in AhsayCBS are being actively exploited by threat actors.
- Exploitation allows unauthenticated remote code execution with SYSTEM privileges.
- Compromised servers have been used to host web shells and cryptocurrency miners.
Threat actors are actively exploiting two zero-day vulnerabilities in Ahsay Cloud Backup Server (AhsayCBS) to compromise backup infrastructure. According to a report by GBHackers, attackers are leveraging these flaws to gain unauthorized access to exposed servers without requiring authentication credentials.
The exploitation grants attackers the ability to execute commands with SYSTEM privileges on affected machines. This high-level access allows for complete control over the compromised backup server. The intrusions have resulted in the deployment of web shells and cryptocurrency mining software on the targeted systems.
Context and Background
Field Effect published a report on October 9, 2026, detailing the active exploitation of these vulnerabilities. The report confirms that the attacks began prior to this publication date and are ongoing. The vulnerabilities are classified as zero-days because they are unknown to the vendor or lack public patches at the time of exploitation.
The GBHackers summary highlights that these intrusions expose significant weaknesses in the infrastructure responsible for centrally managing backup operations. Backup servers often contain sensitive data and are critical for business continuity, making them high-value targets for cybercriminals. The use of unauthenticated attacks suggests that the vulnerabilities bypass standard security controls entirely.
Who Is Affected
Organizations using Ahsay Cloud Backup Server are at risk if their instances are exposed to the internet. The attacks specifically target exposed backup servers, indicating that network segmentation or firewall misconfigurations may be contributing factors. Any deployment of AhsayCBS that is accessible from external networks is potentially vulnerable to this specific exploit chain.
The impact extends beyond simple data theft, as the execution of cryptocurrency miners consumes system resources and degrades performance. The deployment of web shells provides attackers with persistent access, allowing them to maintain control over the server even after initial intrusion detection. This persistence complicates remediation efforts for security teams.
What should you do?
Security teams should immediately verify if their AhsayCBS instances are exposed to the public internet. Network administrators should review firewall rules to ensure that backup servers are not accessible from untrusted networks. Monitoring for unusual outbound traffic or high CPU usage can help detect active cryptocurrency mining or command-and-control communications.
Background: Intrusion detection systems
Intrusion prevention systems inspect network traffic in real time to identify and block malicious activity. They analyze packet headers and payloads against known threat signatures or behavioral anomalies. When a match occurs, the system automatically drops the connection or resets the session, stopping the attack before it reaches your internal infrastructure.
Read the full guide: How Intrusion Prevention Systems Work: Mechanisms and Blind Spots
What to do and how to stay safe: AhsayCBS
- Audit network perimeter configurations to ensure AhsayCBS instances are not directly exposed to the internet
- Monitor system logs and process lists for unauthorized web shells or mining processes
- Restrict administrative access to AhsayCBS management interfaces using strict IP whitelisting
- Isolate compromised backup servers from the network to prevent lateral movement while investigating
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Ahsay Cloud Backup Server?
AhsayCBS is a software solution used for centrally managing backup operations and data recovery for organizations.
Are patches available for these zero-day vulnerabilities?
No fix has been confirmed yet, as the vulnerabilities are currently classified as zero-days and actively exploited.
What privileges do attackers gain through this exploit?
Attackers gain SYSTEM-level privileges, allowing them to execute commands with full administrative control over the server.
