Attackers deliver ShadowPad via newly patched WSUS RCE bug

Attackers exploited a recently patched WSUS vulnerability (CVE-2025-59287) to deliver ShadowPad malware, a backdoor associated with China-linked APT groups. The flaw allows unauthorized remote code execution, enabling attackers to gain access to WSUS-enabled servers. After exploiting the vulnerability, they used PowerCat to obtain a shell and installed ShadowPad using legitimate Windows utilities like curl and certutil.

Microsoft released an out-of-band fix for this critical vulnerability, which has a CVSS score of 9.8. Organizations are advised to patch the vulnerability, restrict WSUS access, and monitor for suspicious activity.