Loading story…
Threat actors have exploited a critical deserialization vulnerability in Microsoft Windows Server Update Services (WSUS), identified as CVE-2025-59287, to gain remote code execution with system privileges and deploy the ShadowPad backdoor. The attackers targeted publicly exposed WSUS-enabled Windows Servers, using the PowerCat utility to obtain a system shell and then leveraging legitimate Windows tools such as curl.exe and certutil.exe to download and install ShadowPad from an external server. ShadowPad, a modular backdoor associated with Chinese state-sponsored groups, is loaded via DLL side-loading techniques, specifically using a legitimate binary to execute a malicious DLL payload in memory.
The vulnerability, which was patched by Microsoft in October, allows remote, unauthenticated attackers to trigger unsafe deserialization of AuthorizationCookie objects, leading to full system compromise. Security researchers from AhnLab and others have documented the attack chain, noting that the flaw has been added to CISA's Known Exploited Vulnerabilities catalog and that a public proof-of-concept exploit is available. The incident highlights the ongoing risk posed by unpatched WSUS servers and the sophisticated methods used by threat actors to maintain persistence and evade detection once ShadowPad is installed.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
Security reporting linked the ShadowPad deployment campaign to Chinese state-aligned threat actors, with references to groups such as APT41, APT10, and PLA-affiliated clusters. The activity was described as targeting sectors including manufacturing, telecom, and energy.
Following evidence of active exploitation, CISA added CVE-2025-59287 to its Known Exploited Vulnerabilities catalog and pushed for urgent remediation. Subsequent reporting also described mandated or strongly urged patching and access restrictions for affected organizations.
AhnLab Security Intelligence Center reported observing the WSUS exploitation chain in the wild, detailing the use of legitimate Windows binaries and the delivery of ShadowPad. Its findings provided technical confirmation of ongoing attacks against publicly exposed WSUS instances.
Attackers actively exploited CVE-2025-59287 to gain SYSTEM-level access on WSUS servers, using PowerCat for shell access and certutil and curl to download ShadowPad. The malware was deployed via DLL sideloading and used persistence and anti-detection techniques, with some intrusions also involving reconnaissance and tools such as Velociraptor.
After proof-of-concept exploit code for CVE-2025-59287 was publicly released, attackers quickly began weaponizing the flaw against exposed WSUS servers. Reports describe this publication as the catalyst for active exploitation.
Microsoft released an out-of-band patch for CVE-2025-59287, a critical unsafe deserialization flaw in the WSUS GetCookie() endpoint that can allow unauthenticated remote code execution as SYSTEM. Multiple reports place the patch release in October 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
foresiet.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders have tied **ShadowPad**, a privately sold modular backdoor associated with multiple PRC-linked espionage operations, to both major supply-chain compromises and ongoing targeted intrusions. ShadowPad has appeared in high-profile cases including **CCleaner**, **NetSarang**, and **ASUS ShadowHammer**, while a separate campaign used a trojanized installer for Pakistan’s government **E-Office** application to sideload a malicious `mscoree.dll` loader and deploy an encrypted ShadowPad payload. Trend Micro observed victims in Pakistan spanning a government entity, a public sector bank, and a telecommunications provider, with follow-on activity including credential theft via Mimikatz and data exfiltration over PowerShell BITS. ShadowPad was also among the malware families deployed after mass exploitation of Microsoft Exchange zero-days, underscoring its role as a reusable espionage platform across both opportunistic and highly selective operations. Defenders have responded by reverse engineering ShadowPad’s custom TCP, HTTP(S), and UDP command-and-control protocols and using protocol emulation to scan the Internet for live servers that would evade reputation-based detection. VMware and Virus Bulletin research identified dozens of active ShadowPad C2 nodes—roughly **72 to 83 servers** across overlapping study periods—and found that some accepted multiple protocols on the same port and overlapped with infrastructure used by **Spyder** and **ReverseWindow**. One previously identified ShadowPad C2 IP later surfaced in a real incident response case, showing that proactive C2 discovery can expose stealthy intrusions before conventional indicators trigger. Researchers caution that ShadowPad’s commercial, shared-use model complicates attribution, making infrastructure correlation and long-term tracking more reliable than assuming any single actor is responsible.
Aug 15, 2026
Researchers reported a cyber-espionage campaign using the **ShadowPad** backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to **`CVE-2021-26855`**, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious **`mscoree.dll`** loader and encrypted payloads under **SYSTEM** privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to **HAFNIUM**; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate **AppLaunch.exe**, DLL hijacking via **OleView** with **`IVIEWERS.dll`** and **`IVIEWERS.dll.dat`**, and web-shell access consistent with tooling such as **China Chopper**. Post-compromise operations included credential theft, lateral movement, scheduled tasks, **Cobalt Strike**, **PlugX**, **Mimikatz**, **procdump**, **Nextnet** scanning, RAR archiving, and data exfiltration over **BITS**, indicating a sustained effort to harvest sensitive information from strategically important networks.
Aug 14, 2026
A critical remote code execution (RCE) vulnerability was discovered in Microsoft's Update Health Tools (KB4023057), a utility designed to facilitate rapid security updates via Intune. Researchers found that a misconfiguration involving abandoned Azure blob storage allowed attackers to register a storage account and receive requests from vulnerable devices worldwide, enabling arbitrary code execution. Microsoft has since responded to the disclosure, and newer versions of the tool have addressed the issue, but devices running the original version remain at risk if not updated. Separately, a remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, was actively exploited by threat actors to deploy the ShadowPad backdoor malware. Attackers leveraged this flaw to gain system-level access using PowerCat and subsequently installed ShadowPad via `certutil` and `curl`. The exploitation of these vulnerabilities highlights the risks associated with update management tools and the importance of timely patching and secure configuration to prevent compromise by advanced persistent threats.
Jul 12, 2026