AhsayCBS RCE Chain Deployed Against Five MSPs for Webshell and Kernel Miner Persistence

The defects permit argument manipulation for auth bypass followed by OS command injection. Huntress telemetry shows five organizations compromised by October 8, with post-exploitation including reconnaissance, Task Manager-killing PowerShell, and WinRing0x64.sys for kernel miner privileges. All versions through 10.3.4 remain unpatched despite NIST disclosure on October 4.

AhsayCBS is marketed to MSPs and integrators for centralized backup management; the exposed web console therefore functions as a supply-chain entry point. Similar patterns appear in the 2021 Kaseya VSA and 2023 ConnectWise ScreenConnect incidents, where unpatched management planes enabled downstream customer access. Procurement records show Ahsay contracts with government-adjacent integrators, yet no public SBOM or vulnerability disclosure policy exists.

Independent confirmation is limited to Huntress sinkhole data and NIST NVD entries; no vendor patch timeline or CVE assignment details have been released. The attribution split is clear: technical artifacts indicate opportunistic cryptomining crews, while official statements have not named actors.

Organizations must restrict the CBS web interface to VPN or allow-listed IPs immediately. Next indicator to watch is whether Ahsay publishes a fixed build before the end of October or whether additional victims surface in MSP telemetry feeds.