ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-59287 | Deserialization RCE in Microsoft WSUS (Windows Server) CVE-2025-59287 is a deserialization of untrusted data flaw (CWE-502) in the Microsoft Windows Server Update Service (WSUS) that permits remote code execution. It is triggered when the WSUS service processes attacker-controlled serialized input, allowing an attacker to run arbitrary code on the server hosting the WSUS role. Organizations running WSUS are affected — typically enterprises that use the role for internal Windows update management — and CISA lists the affected scope as Microsoft Windows broadly. The issue is confirmed exploited in the wild: it was added to the CISA KEV catalog on 2025-10-24, and the EPSS model assigns a 100% (100th percentile) probability of exploitation within 30 days, though no public proof-of-concept is known. CVSS scoring is not yet available, so defenders should treat it as a high-priority remote code execution issue until more detail is published. Do: Apply Microsoft's latest WSUS security updates on every Windows Server with the WSUS role enabled and verify patch status through your update and configuration-management tooling. Where the WSUS role is not required, disable or remove it, and restrict inbound network access to WSUS service ports (typically TCP 8530/8531) from untrusted networks. Federal agencies must apply the required mitigations per CISA BOD 22-01 given the KEV listing. | 9.8 | 100% | KEV PoC |
| largetens of thousands of internet-exposed WSUS servers, within a global deployment base plausibly exceeding 100,000 |
Full article375 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 24, 2025Malware / Vulnerability
A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute a malware known as ShadowPad.
"The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access," AhnLab Security Intelligence Center (ASEC) said in a report published last week. "They then used PowerCat, an open-source PowerShell-based Netcat utility, to obtain a system shell (CMD). Subsequently, they downloaded and installed ShadowPad using certutil and curl."
ShadowPad, assessed to be a successor to PlugX, is a modular backdoor widely used by Chinese state-sponsored hacking groups. It first emerged in 2015. In an analysis published in August 2021, SentinelOne called it a "masterpiece of privately sold malware in Chinese espionage."
CVE-2025-59287, addressed by Microsoft last month, refers to a critical deserialization flaw in WSUS that could be exploited to achieve remote code execution with system privileges. The vulnerability has since come under heavy exploitation, with threat actors using it to obtain initial access to publicly exposed WSUS instances, conduct reconnaissance, and even drop legitimate tools like Velociraptor.
 |
| ShadowPad installed via CVE-2025-59287 exploit |
In the attack documented by the South Korean cybersecurity company, the attackers have been found to weaponize the vulnerability to launch Windows utilities like "curl.exe" and "certutil.exe," to contact an external server ("149.28.78[.]189:42306") to download and install ShadowPad.
ShadowPad, similar to PlugX, is launched by means of DLL side-loading, leveraging a legitimate binary ("ETDCtrlHelper.exe") to execute a DLL payload ("ETDApix.dll"), which serves as a memory-resident loader to execute the backdoor.
Once installed, the malware is designed to launch a core module that's responsible for loading other plugins embedded in the shellcode into memory. It also comes fitted with a variety of anti-detection and persistence techniques. The activity has not been attributed to any known threat actor or group.
"After the proof-of-concept (PoC) exploit code for the vulnerability was publicly released, attackers quickly weaponized it to distribute ShadowPad malware via WSUS servers," AhnLab said. "This vulnerability is critical because it allows remote code execution with system-level permission, significantly increasing the potential impact."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/11/shadowpad-malware-actively-exploits.html