A newly patched critical flaw in Microsoft Windows Server Update Services (WSUS) is now being actively exploited to deploy the powerful ShadowPad backdoor.
South Korea’s AhnLab Security Intelligence Center (ASEC) reports that attackers:
🛑 Exploited CVE-2025-59287, a remote code execution flaw in WSUS
🚪 Gained system-level access on exposed Windows servers
💻 Used PowerCat to obtain remote shells
📥 Downloaded ShadowPad using certutil and curl
🧬 Deployed ShadowPad via DLL side-loading using a legitimate binary
🔍 What is ShadowPad?
ShadowPad is a sophisticated modular backdoor linked to Chinese state-sponsored espionage operations, often considered PlugX’s successor. It’s stealthy, memory-resident, and highly extensible.
🧩 Why This Matters
After public release of proof-of-concept exploit code, attackers quickly weaponized the vulnerability to:
🔹 Perform reconnaissance
🔹 Drop legitimate tools like Velociraptor
🔹 Achieve SYSTEM-level access
🔹 Deploy advanced persistent malware
ASEC warns that the exploit’s system-level RCE capability makes CVE-2025-59287 particularly dangerous.
🔐 Mitigation
✔ Apply Microsoft’s out-of-band patch immediately
✔ Disable WSUS Server role if not required
✔ Block external access to WSUS instances
✔ Review logs for abnormal use of certutil, curl, PowerShell, or ETDCtrlHelper.exe
✔ Hunt for ShadowPad loaders (ETDApix.dll)
