Vietnam Newsroom & Threat Intelligence
Evidence first. Intelligence that matters.
NOTEDo not attribute a ransomware family from a file extension or a single ransom note.Vietnam time · UTC+7
Home/International/AhsayCBS: earlier patches incomplete; review backup servers
International

AhsayCBS: earlier patches incomplete; review backup servers

Research published on 15 October adds evidence of AhsayCBS exploitation. Check replacement hotfixes and compromise traces; ransomware was not observed in the described cases.

Ransomware.VNPublished 2 min read

Updated: · Vietnam time (UTC+7)

Editorial AhsayCBS illustration with two CVE identifiers, a backup server and replacement hotfix builds, Ransomware.VN logo, Vietnam flag and original TUNGTEK signature.
Editorial illustration · Original TUNGTEK signature · Not incident evidence.
Verified

Cross-checked Ahsay, Bitdefender, Huntress and NVD publications. Ransomware.VN has not independently investigated the systems or malware samples and has not confirmed any Vietnam victim.

Published on 16 October 2026, based on new research dated 15 October and the vendor hotfix notice dated 12 October. This is a backup-infrastructure advisory, not confirmation of a ransomware campaign.

Evidence / published sources

Bitdefender MDR reported observing exploitation of the AhsayCBS chain. It observed no encryption, data exfiltration or ransomware deployment in the described cases. The activity is not assigned to a ransomware family.

Evidence / published sources

Ahsay's 12 October notice says v10.3.4.0 and v9.15.2.59 were incomplete fixes. It directs v10 users to hotfix v10.3.4.45 and v7, v8 and v9 users to v9.15.2.70, followed by a server reboot. Huntress also verified hotfix v10.3.4.45 against this entry point.

Evidence / published sources

NVD classifies CVE-2026-105133 as improper authentication and CVE-2026-105134 as OS command injection. Older NVD wording still lists 10.3.4 as unaffected; version decisions should be checked against Ahsay's newer build-specific guidance.

Technical assessment
  • Inventory AhsayCBS servers, check complete build numbers and network reachability, and contact your provider if backup is operated as a service.
  • Patching and compromise assessment are separate tasks: preserve logs and review webshells, unusual child processes and unauthorized remote-access services. If compromise indicators are found, isolate the host and plan trusted recovery.
  • Ransomware.VN recommends restore testing and a separate backup copy. This is a defensive priority, not evidence that backups have been destroyed.
CVEBackupTechnicalIncident Response
Bitdefender — AhsayCBS Exploitation Chain15/10/2026 · MDR research dated 15 October; exploitation observed, but no ransomware or data exfiltration observed in the described cases.
Ahsay — Cập nhật cảnh báo và hotfix12/10/2026 · Vendor source: incomplete earlier patches, replacement builds for v10 and v7–v9, and reboot requirement.
Huntress — AhsayCBS exploitation, cập nhật 12/10Cập nhật 12/10/2026 · Independent research cross-check: hotfix 10.3.4.45 verified to mitigate the tested entry point; compromise-assessment guidance.
NVD — CVE-2026-10513304/10/2026 · Improper-authentication classification. Version wording must be read alongside the newer Ahsay notice.
NVD — CVE-2026-10513404/10/2026 · OS command-injection classification; older version fields do not establish that an installed build is safe.

Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.

· Published VI/EN editions, cross-checking 15 October research and 12 October hotfix guidance. Exploitation evidence is separated from ransomware risk; no Vietnam impact confirmed.

Corrections policy
N
Ransomware.VN

AI-assisted editorial summary. Public sources and verification limits are stated for each article.