Hackers have exploited vulnerabilities in AhsayCBS, a cloud backup and disaster recovery software used by over 150,000 businesses worldwide. The attackers compromised systems to secretly deploy Monero cryptocurrency miners disguised as Microsoft Edge browser updates. This sophisticated campaign highlights the ongoing threat of supply chain attacks and the importance of robust security measures.
AhsayCBS is designed to securely back up and store data in the cloud, but its vulnerability has allowed hackers to gain access to affected networks. Once inside, they use a technique called cross-domain privilege escalation (CPE) to escalate their privileges and move undetected throughout the network. This allows them to deploy malware, such as the XMRig miner, which uses system resources to mine cryptocurrency without the user’s knowledge or consent.
The attackers’ tactics are particularly insidious because they masquerade as legitimate Microsoft Edge updates. This makes it even more challenging for security teams to detect and respond to the breach. The use of CPE also enables the hackers to navigate across different domains, exploiting vulnerabilities in systems that might not be directly connected to AhsayCBS.
The scale of this attack is significant: over 150,000 businesses worldwide rely on AhsayCBS, including small to medium-sized enterprises and large corporations with complex IT infrastructures. The potential financial impact for organizations affected by this breach could be substantial, as hackers can mine cryptocurrency using system resources without being detected.
This campaign serves as a stark reminder of the importance of maintaining robust security measures, particularly in the context of supply chain attacks. Businesses relying on cloud-based services like AhsayCBS must ensure that their systems are regularly updated and monitored for potential vulnerabilities. Additionally, it is crucial to implement strict access controls and monitoring mechanisms to detect and respond to suspicious activity.
To protect your organization from similar attacks, consider implementing a layered security approach that includes regular software updates, network segmentation, and robust threat detection and response capabilities. This will help you stay ahead of sophisticated attackers who seek to exploit vulnerabilities in software applications like AhsayCBS.
Source: The Hacker News — 2026-10-09