Critical WSUS RCE (CVE-2025-59287) Actively Exploited to Deploy ShadowPad Backdoor

According to AhnLab Security Intelligence Center (ASEC), there is an active exploitation campaign abusing a newly disclosed WSUS remote code execution vulnerability (CVE-2025-59287) to distribute ShadowPad, a backdoor linked to multiple Chinese state-aligned APT groups.

The attackers first targeted Windows Servers with WSUS enabled, using the vulnerability for initial access and then employing PowerCat to obtain a system shell, with a log showing a command that downloads powercat.ps1 and establishes a reverse connection. On 6 November, the same WSUS RCE was used again to drop and decode ShadowPad components via Windows utilities such as curl.exe and certutil.exe, including tmp.txt, dll.txt, and exe.txt, where the .tmp file contains encrypted backdoor data.

ShadowPad is typically hidden behind legitimate executables and is used in supply-chain intrusions, critical infrastructure breaches, and long-term espionage campaigns. Microsoft issued an advisory on 14 October, and PoC code was released publicly by 22 October, after which telemetry detected PowerCat activity. Administrators are urged to apply the latest security update addressing CVE-2025-59287, restrict WSUS access to Microsoft Update servers, and audit for suspicious PowerShell and related utility activity.