UNPATCHED AHSAYCBS FLAWS EXPLOITED TO DEPLOY WEBSHELLS AND MINE CRYPTO

Summary from the TLDR InfoSec newsletter

Huntress has observed attackers chaining two vulnerabilities in the AhsayCBS backup software to achieve remote code execution (RCE). The attackers utilize an authentication bypass and then RCE vulnerability to install JSP webshells and the XMRig crypto miner as well as an AI-assisted script to avoid detection. The vulnerabilities were meant to be fixed in version 10.3.2 but Huntress reports that version 10.3.4 is still vulnerable.