Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: cryptomining

CVE-2026-105133: AhsayCBS Improper Authentication Vulnerability Exploited

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-105133 is an improper authentication vulnerability in Ahsay AhsayCBS versions up to 10.3.2. This flaw allows remote attackers to bypass authentication via manipulation of a specific API parameter. The vulnerability is actively exploited in the wild, often chained with CVE-2026-105134, leading to post-exploitation activities such as webshell deployment and cryptominer installation.

Technical Analysis

  • Vulnerability: Improper Authentication (CWE-287).
  • Affected Software: Ahsay AhsayCBS up to version 10.3.2.
  • Affected Component: API component, specifically the checkSysPwd function within com/ahsay/obs/api/ApiStructsAction.java.
  • Attack Vector: Remote attackers can manipulate the random argument during API calls to bypass authentication.
  • CVSS 3.1 Score: 7.3 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. This indicates a network-based attack, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.
  • Exploitation: The exploit is public and actively used. It can be chained with CVE-2026-105134 for further compromise.
  • Observed Post-Exploitation: Deployment of webshells and XMRig cryptominer.

Detection

  • Monitor web server access logs for suspicious requests to the /obs/api/ApiStructsAction.java endpoint, particularly those manipulating the random parameter or exhibiting unusual authentication patterns (e.g., failed authentication followed by immediate success without valid credentials).
  • Look for unexpected file creations or modifications in web root directories, indicative of webshell deployment (e.g., .jsp, .php, .aspx files).
  • Monitor for new, unauthorized processes, especially those related to cryptomining (e.g., xmrig.exe, miner.exe) or unusual command-line executions originating from the AhsayCBS process.
  • Detect outbound network connections from AhsayCBS servers to known cryptomining pools or unusual C2 infrastructure.
  • Monitor for sustained high CPU utilization on AhsayCBS servers, which could indicate cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

AhsayCBS API Improper Authentication Attempt

title: AhsayCBS API Improper Authentication Attempt
id: 902b7194-c71b-4d2a-a22a-1c3906a1a123
status: experimental
description: Detects suspicious access patterns to the AhsayCBS API endpoint related to CVE-2026-105133.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/obs/api/ApiStructsAction.java'
  condition: selection
level: medium

AhsayCBS Webshell Deployment in Web Root

title: AhsayCBS Webshell Deployment in Web Root
id: 7e7f8e1d-c3d9-4b1a-8b0c-0a1b2c3d4e5f
status: experimental
description: Detects creation of suspicious files (potential webshells) in the AhsayCBS web application directory.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|contains|all:
      - '\AhsayCBS\webapps\obs\'
    TargetFilename|endswith:
      - '.jsp'
      - '.aspx'
      - '.php'
  condition: selection
level: high

XMRig Cryptominer Process Execution

title: XMRig Cryptominer Process Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-e1f2a3b4c5d6
status: experimental
description: Detects common process names or command-line arguments associated with XMRig cryptominer activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    EventID: 1
    Image|contains:
      - 'xmrig'
      - 'miner'
  selection_cmdline:
    EventID: 1
    CommandLine|contains|all:
      - '--donate-level'
      - '-o'
  condition: 1 of selection_*
level: critical

Mitigations

  1. Upgrade Ahsay AhsayCBS to version 10.3.4 or later immediately.
  2. Implement network segmentation to restrict access to AhsayCBS servers from untrusted networks.
  3. Deploy a Web Application Firewall (WAF) to detect and block suspicious API requests and webshell uploads.
  4. Regularly audit AhsayCBS server logs for signs of compromise, including unauthorized file changes and process execution.
  5. Ensure endpoint detection and response (EDR) solutions are deployed and configured to detect cryptomining activity and suspicious process behavior.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-105133
  • https://vuldb.com/cve/CVE-2026-105133
  • https://vuldb.com/submit/942688
  • https://vuldb.com/vuln/413350
  • https://vuldb.com/vuln/413350/cti
  • https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105133
  • https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 Modified NSSM utility (msedge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 Powershell script (Taskgmr.ps1) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d XMRig miner (edge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
IP Address 51.195.127.124 XMR cryptomining pool IP address (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting domain (Alibaba Cloud Object Storage) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain xmr.kryptex.network XMR cryptomining pool domain (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
URL http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting server for various files (Taskgmr.ps1, msedge.exe, edge.exe, config.json, WinRing0x64.sys) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078 — Valid Accounts
  • T1505.003 — Web Shell
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1564 — Hide Artifacts
  • T1543.003 — Windows Service
  • T1608.001 — Upload Malware
  • T1036.004 — Masquerade Task or Service
  • T1057 — Process Discovery
  • T1059.001 — PowerShell
  • T1571 — Non-Standard Port
  • T1059.003 — Windows Command Shell
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1569.002 — Service Execution
  • T1124 — System Time Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,120 input / 1,803 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ahsaycbs, cryptomining, high, improper authentication, known_exploited, vulnerability, webshell, xmrigLeave a comment

CVE-2026-105134: AhsayCBS Command Injection Vulnerability Actively Exploited

Posted on October 17, 2026 by Kyle

Overview

CVE-2026-105134 is a critical command injection vulnerability impacting Ahsay AhsayCBS backup software, specifically within its Replication Receiver component. This flaw enables unauthenticated remote attackers to execute arbitrary operating system commands by manipulating the random parameter in the /rps/api/json/UpdateReceivers.do endpoint. The vulnerability is actively exploited, with observed attacks deploying webshells and XMRig cryptominers.

Technical Analysis

This vulnerability exists in Ahsay AhsayCBS versions up to 10.3.2. The flaw is located in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. A remote attacker can achieve OS command injection by manipulating the random argument within requests to this endpoint. The vulnerability has a CVSS 3.1 score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating network-exploitable, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

  • Affected Component: Replication Receiver
  • Affected Endpoint: /rps/api/json/UpdateReceivers.do
  • Vulnerable Parameter: random
  • Affected Versions: Ahsay AhsayCBS up to 10.3.2
  • Attack Vector: Remote, unauthenticated command injection via HTTP/HTTPS requests.
  • Weaknesses: CWE-77 (Improper Neutralization of Special Elements used in a Command (‘Command Injection’)), CWE-78 (Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’))
  • Chaining: This vulnerability can be chained with CVE-2026-105133 for potentially broader impact.
  • Post-Exploitation: Observed post-exploitation activities include the deployment of webshells and XMRig cryptominers.

Detection

Defenders can identify exploitation attempts and post-exploitation activity through various log sources and behavioral indicators:

  • Web Server Logs: Monitor access logs for requests to /rps/api/json/UpdateReceivers.do where the random parameter in the query string or POST body contains suspicious characters indicative of command injection (e.g., &, |, ;, $(, `).
  • Process Creation Logs (Windows/Linux): Look for unusual child processes spawned by the AhsayCBS service process (e.g., AhsayCBS.exe, java.exe, or similar) that include cmd.exe, powershell.exe, sh, bash, python.exe, or other scripting interpreters.
  • File System Monitoring: Detect the creation of suspicious files in web root directories (e.g., .jsp, .php, .asp, .aspx files that are not part of the legitimate application) or the presence of known cryptominer executables like xmrig.exe.
  • Network Activity: Monitor for outbound connections from the AhsayCBS server to unusual IP addresses or domains, especially those associated with cryptomining pools or C2 infrastructure.
  • Resource Utilization: Look for sudden spikes in CPU usage on the AhsayCBS server, which could indicate cryptomining activity.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

AhsayCBS CVE-2026-105134 Exploitation Attempt

title: AhsayCBS CVE-2026-105134 Exploitation Attempt
id: 7e2f1b3c-d4a5-4e6f-8b0c-9a1d2e3f4a5b
status: experimental
description: Detects attempts to exploit CVE-2026-105134 in AhsayCBS by looking for suspicious requests to the vulnerable endpoint with command injection patterns.
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/rps/api/json/UpdateReceivers.do'
  selection_injection_patterns:
    cs-uri-query|contains:
      - '&'
      - '|'
      - ';'
      - '`'
      - '$('
      - '||'
      - '&&'
  condition: selection_uri and selection_injection_patterns
level: high

AhsayCBS Service Spawning Suspicious Processes

title: AhsayCBS Service Spawning Suspicious Processes
id: 8c9d0e1f-a2b3-4c5d-6e7f-0a1b2c3d4e5f
status: experimental
description: Detects post-exploitation activity where the AhsayCBS service process spawns common command interpreters, indicative of command injection success.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\AhsayCBS.exe'
      - '\java.exe' # Common for Java-based services
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
  condition: selection_parent and selection_child
level: critical

XMRig Cryptominer Execution

title: XMRig Cryptominer Execution
id: 9d0e1f2a-b3c4-5d6e-7f8a-9b0c1d2e3f4a
status: experimental
description: Detects the execution of XMRig cryptominer, often deployed after successful exploitation of vulnerabilities like CVE-2026-105134.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmrig-proxy.exe'
    CommandLine|contains:
      - '--donate-level'
      - '-o pool.supportxmr.com'
      - '-u wallet_address'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade Ahsay AhsayCBS to version 10.3.4 or later. This is the primary and most effective mitigation.
  2. Network Segmentation: Isolate AhsayCBS servers on a dedicated network segment with strict egress filtering to limit outbound connections and prevent lateral movement in case of compromise.
  3. Principle of Least Privilege: Ensure the AhsayCBS service runs with the minimum necessary privileges to perform its functions.
  4. Application Whitelisting: Implement application whitelisting to prevent the execution of unauthorized executables (e.g., xmrig.exe, unknown scripting interpreters) on the server.
  5. Regular Backups: Maintain regular, off-site, and immutable backups of critical data to facilitate recovery in the event of a successful attack.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-105134
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-105134
  • https://vuldb.com/cve/CVE-2026-105134
  • https://vuldb.com/submit/942743
  • https://vuldb.com/vuln/413351
  • https://vuldb.com/vuln/413351/cti
  • https://www.ahsay.com/en/support/help-centre/release-notes/cbs/v10.3.4
  • https://www.huntress.com/blog/ahsaycbs-flaws-exploit
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 Modified NSSM utility (msedge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 Powershell script (Taskgmr.ps1) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
SHA256 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d XMRig miner (edge.exe) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
IP Address 51.195.127.124 XMR cryptomining pool IP address (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting domain (Alibaba Cloud Object Storage) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Domain xmr.kryptex.network XMR cryptomining pool domain (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
URL http://imagefiles-backup.oss-ap-southeast-7.aliyuncs.com Payload hosting server for various files (Taskgmr.ps1, msedge.exe, edge.exe, config.json, WinRing0x64.sys) (via https://www.huntress.com/blog/ahsaycbs-flaws-exploit)

MITRE ATT&CK

  • T1059 — Command and Scripting Interpreter
  • T1505.003 — Web Shell
  • T1496 — Resource Hijacking
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1564 — Hide Artifacts
  • T1543.003 — Windows Service
  • T1608.001 — Upload Malware
  • T1190 — Exploit Public-Facing Application
  • T1036.004 — Masquerade Task or Service
  • T1057 — Process Discovery
  • T1059.001 — PowerShell
  • T1571 — Non-Standard Port
  • T1059.003 — Windows Command Shell
  • T1071.001 — Web Protocols
  • T1105 — Ingress Tool Transfer
  • T1569.002 — Service Execution
  • T1124 — System Time Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,137 input / 2,181 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ahsaycbs, command-injection, critical, cryptomining, known_cve, vulnerability, webshell, xmrigLeave a comment

CVE-2026-48710: Starlette HTTP Request/Response Smuggling Vulnerability

Posted on September 6, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-48710 affects Kludex Starlette, a lightweight ASGI framework, specifically versions prior to 1.0.1. The vulnerability stems from insufficient validation of the HTTP Host request header, allowing attackers to inject paths into the host part. This manipulation causes request.url.path to differ from the raw scope path, enabling authentication bypass in middleware or endpoints that rely on request.url for security decisions. This vulnerability can be chained with others, such as CVE-2026-42271.

Technical Analysis

Starlette versions before 1.0.1 do not adequately validate the HTTP Host request header before using it to reconstruct request.url. The routing algorithm, however, relies on the raw HTTP path (scope path). An attacker can craft a malformed Host header to prepend paths or inject other characters, causing request.url.path to diverge from the actual requested path.

  • Vulnerability Type: HTTP Request/Response Smuggling (CWE-444), Improper Input Validation (CWE-1289).
  • Affected Versions: encode starlette versions >= 0.8.3 and < 1.0.1. Various Red Hat products including ai_inference_server, ansible_automation_platform, migration_toolkit_for_applications, openshift_ai, openshift_lightspeed, and satellite are also affected.
  • Attack Vector: Network-based, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N).
  • Impact: Authentication bypass, potentially leading to unauthorized access to resources. Can be chained with other vulnerabilities for broader impact, including remote code execution or cryptomining as observed in community intelligence.
  • Prerequisites: The application must be using an affected version of Starlette, and security-sensitive middleware or endpoints must rely on request.url for access control decisions.
  • Resolution: Starlette version 1.0.1 and later validate the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and fall back to scope["server"] for malformed values.

Detection

Defenders can identify potential exploitation attempts by monitoring web server and application logs for anomalies related to the Host header.

  • Web Server Logs: Monitor Host header fields (e.g., cs-host, Host) for the presence of path separators (/, \) or their URL-encoded equivalents (%2f, %2F, %5c, %5C). These characters are invalid within the hostname part of a standard HTTP Host header.
  • Application Logs: Look for unexpected authentication bypasses, unauthorized access to restricted resources, or unusual requests to internal paths that do not align with expected user behavior, especially when correlated with suspicious Host headers.
  • WAF/API Gateway Logs: Review logs for requests flagged due to malformed Host headers or unusual URL structures that might indicate an attempt to exploit this vulnerability.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Starlette CVE-2026-48710 Malformed Host Header Path Separator

title: Starlette CVE-2026-48710 Malformed Host Header Path Separator
id: 757d59b2-3e2a-4f5b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-48710 by injecting path separators into the HTTP Host header, which can lead to request smuggling and authentication bypass in Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '/'
      - '\'
  condition: selection
level: high

Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path

title: Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path
id: 8f9e0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects attempts to exploit CVE-2026-48710 using URL-encoded path separators in the HTTP Host header, indicative of request smuggling or authentication bypass attempts against Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '%2f'
      - '%2F'
      - '%5c'
      - '%5C'
  condition: selection
level: high

Mitigations

Prioritize patching and configuration changes to address this vulnerability.

  1. Upgrade Starlette: Immediately upgrade Kludex Starlette to version 1.0.1 or greater. This version includes robust validation for the Host header.
  2. Apply Vendor Patches: For affected Red Hat products, apply the latest security updates and patches provided by Red Hat.
  3. Implement WAF/API Gateway Rules: Configure Web Application Firewalls (WAFs) or API gateways to strictly validate the Host header, blocking requests where the Host header contains path separators or other non-standard characters.
  4. Review Application Logic: Ensure that security-sensitive middleware and application endpoints rely on the raw scope path for access control and routing decisions, rather than the potentially manipulated request.url.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-48710
  • https://badhost.org
  • https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
  • https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
  • https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
  • https://www.secwest.net/starlette
  • https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
  • https://www.wiz.io/blog/ai-infrastructure-honeypot
  • https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
  • https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
  • https://nvd.nist.gov/vuln/detail/CVE-2026-42271
  • https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
  • https://ltna.com.au/cyber

Indicators of Compromise

Type Value Description
SHA256 3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42 LiteLLM — XMRig cryptominer binary (variant) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0 LiteLLM — installer / bridge script (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f LiteLLM — XMRig cryptominer binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256 f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc LiteLLM #2 — unknown ELF binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 135.125.10.56 RAGFlow exploitation C2 — LLM API key exfiltration endpoint (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 172.232.38.92 Kestra reverse shell C2 (Linode VPS) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 194.213.18.133 Attacker-controlled mail MX / mail infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 45.150.109.151 Scanning/recon infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address 47.86.197.116 c3pool mining endpoint (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain 45.150.109.151.sslip.io DNS rebinding used in LiteLLM attacks (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain auto.c3pool.org XMRig Monero mining pool (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain gobygo.net C2 beacon infrastructure — subdomain-encoded LiteLLM beacons (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.fun Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.me Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain oast.pro Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain yosemite.jp C2/exfiltration endpoint — LiteLLM credential harvesting (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078.004 — Cloud Accounts
  • T1071.004 — DNS
  • T1036.005 — Match Legitimate Resource Name or Location
  • T1082 — System Information Discovery
  • T1071 — Application Layer Protocol
  • T1036 — Masquerading
  • T1552 — Unsecured Credentials
  • T1055 — Process Injection
  • T1552.004 — Private Keys
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1027 — Obfuscated Files or Information
  • T1059.006 — Python
  • T1496 — Resource Hijacking
  • T1518 — Software Discovery
  • T1105 — Ingress Tool Transfer
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,721 input / 2,018 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged ai infrastructure, asgi, authentication bypass, cryptomining, http smuggling, medium, post-exploitation, python, starlette, vulnerability, web applicationLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.