ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access

A recently patched security flaw in Microsoft Windows Server Update Services (WSUS) has been exploited by threat actors to distribute ShadowPad, a modular backdoor. The attacker targeted Windows Servers with WSUS enabled, exploiting CVE-2025-59287 for initial access, according to ASEC (AhnLab Security Intelligence Center).

They used PowerCat to obtain a system shell and then downloaded and installed ShadowPad using certutil and curl, with the malware designed to be loaded via DLL side-loading through ETDCtrlHelper.exe to run ETDApix.dll as a memory-resident loader. Once installed, ShadowPad can load additional plugins embedded in the shellcode and employs anti-detection and persistence techniques.

The campaign has seen actors weaponise the vulnerability to contact an external server, 149.28.78[.]189:42306, to download ShadowPad, and the operation is described as enabling remote code execution with system privileges. ShadowPad is regarded as a successor to PlugX and has been linked to Chinese state-sponsored hacking groups.