Search — “XMRig”

Huntress analyzed three Windows AhsayCBS servers breached Oct 8-11, 2026 via an auth bypass and unauthenticated SYSTEM RCE through /rps/api/json/UpdateReceivers.do. The operator planted five JSP webshell families (including a PNG-steganography loader and a signed-API shell), an XMRig miner relaunched by a SYSTEM scheduled task every minute, a MachineGuid-keyed Python implant launched from a Run key, tunneling tools (gost, chisel), RMM tools, Defender exclusions, and a NetExec-style Veeam credential query. Hunt for cbssvcX64.exe spawning cmd.exe, new .jsp files in webapps\cbs and webapps\rps, ahsay_* and Linux-style folders at the drive root, the kvm task, and python.exe under the SYSTEM profile.

A brief item reports that the Yoba actor distributes fake GitHub projects posing as AI apps, with legitimately signed OpenAI and Anthropic binaries used to sideload a loader and an XMRig cryptominer. No source could be fetched, so these claims rest only on the brief item and are not confirmed by a primary source. Hunters should look for unexpected DLLs loaded beside signed AI-vendor binaries and XMRig-style mining process activity.

Two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, were chained to bypass authentication and execute arbitrary commands, and were exploited to drop web shells and XMRig cryptominers, per Huntress. Earlier patches in versions 9.15.2.59 and 10.3.4.0 were incomplete, and Ahsay has released hotfixes v10.3.4.45 and v9.15.2.70 that should be applied followed by a server reboot. CISA added the flaws to KEV with a federal remediation deadline of October 17, 2026. Hunters should look for web shells and XMRig activity on exposed AhsayCBS servers, though the source does not print specific file paths or command lines.

Attackers began exploiting the chained Plex2Shell vulnerabilities in Plex Media Server within days of the October 16 public PoC. They dropped XMRig cryptominers and a Linux reverse-proxy backdoor. Neither linked source contained article content, so the technical detail is limited to the brief. Hunters should look for Plex Media Server processes spawning shells or miners, unexpected XMRig binaries, and new proxy or listener processes on Plex hosts. Update to Plex Media Server 1.43.3.10861 or later and remove servers from internet exposure.