ShadowPad Attack Strikes Again: Critical Microsoft WSUS Vulnerability Exploited by Hackers
Attackers are exploiting a patched Windows Server flaw, CVE-2025-59287, to distribute ShadowPad malware. This vulnerability, a critical deserialization flaw in WSUS, enables remote code execution. It’s like leaving your front door unlocked, only to find malware has made itself at home, snuggled on your server, munching on your data cookies!
Hot Take:
When life gives you WSUS vulnerabilities, apparently threat actors make ShadowPad-aid! Microsoft Windows Server Update Services may need a better bouncer at the door since it seems like anyone with a convincing CVE can waltz right in and start serving malware hors d’oeuvres.
Key Points:
- Threat actors exploited a flaw in WSUS to distribute ShadowPad malware.
- The attack used CVE-2025-59287, a deserialization vulnerability, for initial access.
- Tools like PowerCat, curl, and certutil were leveraged for system access and malware installation.
- ShadowPad, a backdoor favored by Chinese state-sponsored groups, was installed via DLL side-loading.
- The vulnerability allows remote code execution, posing significant risks.
Already a member? Log in here