Darktrace’s Analysis of Post-Exploitation Activities on CVE-2025-59287

Darktrace’s analysis of CVE-2025-59287, disclosed by Microsoft on 14 October 2025, details two US-based cases of exploitation involving Windows Server Update Services (WSUS). According to Darktrace, the attackers’ activity began with internet-facing WSUS servers making outbound connections to webhook[.]site, using PowerShell and HTTP POSTs (with some CURL agents) before escalating to two rare workers[.]dev subdomains for command-and-control beaconing on 26 October.

In the first case, an MSI named v3.msi hosted on royal-boat-bf05.qgtxtebl.workers[.]dev contained two Cabinet files, with a Velociraptor tool configuration that pointed to chat.hcqhajfv.workers[.]dev as the server URL and indicated a Velociraptor version vulnerable to CVE-2025-6264.

The attackers are described as using Velociraptor as a tunnel to the C2, and the eventual payload included a UPX-packed Windows binary, which after unpacking revealed the Skuld Stealer capable of stealing crypto wallets, files, and browser data, with anti-debugging and UAC-bypass techniques. The report emphasises that post-exploitation activity varied between cases, and highlights Darktrace’s view that detection should focus on anomalous behaviour and security integrations to provide broader context for response.