ShadowPad: The critical vulnerability in WSUS that opens the door to espionage

Informatec Digital » Resources » ShadowPad: The critical vulnerability in WSUS that opens the door to espionage

In recent months, the cybersecurity ecosystem has been shaken by an attack campaign exploiting a critical vulnerability in Microsoft WSUS to deploy ShadowPad, one of the most sophisticated and feared backdoors currently available. This combination of a security flaw in a key Windows Server component and advanced malware has put numerous organizations at risk, especially those that expose their update servers to the internet without adequate protection.

What's worrying isn't just the vulnerability itself, but how attackers have reacted: after the public release of the proof-of-concept exploit for CVE-2025-59287, threat actors wasted no time in arming it and turning it into a real entry point for their espionage and long-term persistence operations. Let's break down what's happening, how ShadowPad works, why WSUS has become such a tempting target, and what practical measures can be taken to minimize the risk.

What is ShadowPad and why is it causing so much concern?

ShadowPad is an advanced modular backdoor historically associated with espionage groups linked to Chinese interests . It is considered the natural successor to PlugX, another well-known malware in cyber espionage circles. Its primary objective is not to make noise or encrypt data for ransom, but rather to infiltrate stealthily, remain within the network for extended periods, and exfiltrate sensitive information or prepare the ground for subsequent operations.

This malware is characterized by a layered design: it has a main core capable of loading multiple plugins or additional modules , which add capabilities according to the attacker's needs: from stealing credentials and logging keystrokes, to lateral movement, managing internal proxies or using encrypted communication channels that are very difficult to trace.

One of the keys to its success is its focus on evasion: ShadowPad is designed to minimize its disk and memory footprint by employing obfuscation techniques, configuration encryption, and dynamically loading components only when necessary. This seriously complicates detection by traditional antivirus or monitoring solutions that rely solely on static signatures.

Historically, ShadowPad has been used in campaigns targeting service providers, companies in critical sectors, and government organizations , where prolonged access to the victim's environment offers high strategic value to attackers. The fact that it is now distributed through a component as widespread as WSUS significantly increases its danger.

The critical vulnerability in Microsoft WSUS (CVE-2025-59287)

Windows Server Update Services (WSUS) is the infrastructure component that allows businesses to manage and distribute updates for Windows and other Microsoft products within their corporate network. Because of its function, it typically has high privileges and is connected to a large portion of the organization's computers, making it a very attractive target if compromised.

The vulnerability at the heart of these attacks has been identified as CVE-2025-59287, a critical deserialization flaw in WSUS that allows remote code execution with system privileges . Simply put, an attacker can send specially crafted data to the vulnerable WSUS server and cause it to process the information insecurely, ultimately executing malicious code with the highest level of privilege available on the system.

This type of deserialization vulnerability is especially dangerous because it doesn't require the attacker to have valid credentials or for a legitimate user to interact . It's enough that the vulnerable service is exposed and accessible for the right exploit to grant full access to the server with a single request.

Microsoft has already released patches to fix the problem; however, many organizations are slow to apply critical updates to sensitive servers for fear of service disruptions or due to slow internal change processes. This window between patch release and effective deployment is precisely the time threat actors are exploiting.

The fact that an exploit has been published as a proof of concept has accelerated the situation: once the exploit code is made public, both advanced actors and less sophisticated criminals can adapt and use it , exponentially increasing the number of compromise attempts against vulnerable WSUS servers connected to the Internet.

Chain of attack: from vulnerable WSUS to fully deployed ShadowPad

After successfully exploiting CVE-2025-59287, the attackers gained remote code execution with system privileges on the WSUS server . This initial access became the starting point for the rest of the operation. From there, they began deploying a series of tools and utilities to download and activate the ShadowPad backdoor.

Analysis reports, such as the one published by AhnLab and other specialized teams, show that attackers use legitimate tools present in virtually any Windows environment , helping them to remain undetected. Among the most notable are:

• PowerCat: a PowerShell-based tool that allows you to flexibly create network connections, tunnels, and reverse shells.
• certutil: command-line utility included in Windows for managing certificates, which is often abused to download files from the Internet without raising suspicion.
• curl: a tool for transferring data to or from a server, increasingly present in recent Windows installations and very useful for downloading binaries or scripts.

Using these tools, threat actors download the necessary ShadowPad components from external servers they control . This download can be disguised as seemingly legitimate traffic, making detection difficult without in-depth network monitoring.

Once the files are obtained, a classic technique in advanced attacks comes into play: DLL side-loading. Instead of directly launching a malicious executable, the attackers leverage legitimate Windows binaries or other signed applications to load a malicious DLL . The trusted binary, when searching for its libraries, ends up loading the manipulated DLL, which is where the ShadowPad code actually resides.

This approach has several advantages for attackers: they rely on trusted binaries (often signed and widely used) to gain credibility with security solutions , and by loading the DLL directly into memory, they reduce the visibility of malicious files on disk. All of this aligns with ShadowPad's philosophy of operating stealthily and persistently.

Once the backdoor core is activated, it loads its plugins and establishes communication channels with the attackers' command and control (C2) infrastructure , which then gives them very granular control over the compromised server and, potentially, over other computers on the internal network that depend on WSUS for their updates.

Objectives, impact, and tactics of threat actors

The observed campaigns show a clear pattern of espionage operations and prolonged access to corporate environments . These are not low-level opportunistic attacks, but rather carefully planned intrusions that prioritize permanence and discretion over immediate and visible impact.

In one of the incidents analyzed by specialized teams such as the Financial CSIRT, it was identified that after compromising WSUS, the attackers used legitimate system utilities to perform internal operations, gather information, and prepare persistence mechanisms . This preference for tools already present in the system aligns with the tactic known as "Living off the Land," which avoids introducing conspicuous external binaries.

The observed activity included both the installation of services and scheduled tasks to regain control in the event of a reboot, and the creation of channels to maintain communication with the command and control infrastructure over extended periods . For an affected organization, this means that the incident is not limited to a single, isolated event, but rather an intrusion with the potential to persist for months if left undetected.

This type of attack is usually accompanied by a distributed command and control infrastructure, with domains and IP addresses carefully configured to circumvent blacklists and reputation management techniques. ShadowPad operators often switch, rotate, and hide their servers, so that even if one communication channel is blocked, they can easily establish another.

Furthermore, the rapid exploitation following the disclosure of the vulnerability demonstrates a high level of preparedness: threat actors actively monitor the emergence of new critical vulnerabilities and proof-of-concept exploits , adapting their tools and playbooks within days or even hours to integrate them into their attack chains.

Operational context and role of response teams

The campaign linked to ShadowPad and WSUS has been documented by various incident response teams, including the Financial CSIRT, which has published summaries of the activity observed in corporate environments . In the incidents studied, a recurring pattern is confirmed: initial access through the WSUS vulnerability, deployment of legitimate tools, installation of ShadowPad, and consolidation of persistence.

In these types of scenarios, the work of the response teams is not limited to "cleaning" the affected server, but requires a thorough investigation of the network to identify all possible points of contact for the attacker . ShadowPad, due to its modular nature, may have left dormant modules or configurations on other systems, so a partial response is often insufficient.

These teams are also responsible for correlating the technical information of the incident with mitigation and monitoring strategies : detection rules for SIEM, indicators of compromise (IoC), suspicious traffic patterns, firewall and EDR configurations, and recommendations to harden critical services such as WSUS.

For organizations in the financial sector and other regulated industries, having a dedicated CSIRT and direct communication channels for sharing analysis and alerts (including contact emails and newsletters) makes all the difference between detecting an attack in its early stages and discovering it only when the damage is already significant . In the case of ShadowPad, early response capabilities can prevent data breaches, fraudulent use of credentials, and compromise of critical systems.

The date on which some of these analyses were shared, such as the summary dated early December 2025, illustrates that attackers relentlessly exploit windows of opportunity . From the time a patch is released until it reaches all susceptible systems, there is a valuable window of opportunity for both defenders and attackers.

How to reduce risk: mitigation measures and best practices

The first step, though it may seem obvious, is critical: to update WSUS servers affected by the CVE-2025-59287 vulnerability without delay . This involves applying the patches released by Microsoft, verifying that they have been installed correctly, and, in particularly sensitive environments, testing them in a pre-production environment before mass deployment to avoid unexpected disruptions.

Beyond patching, it's crucial to review WSUS's internet exposure . In many cases, these services don't need to be accessible from the public network and should be limited to the internal network or secure VPN connections. Using firewalls, network segmentation, and access control lists to restrict who can communicate with the update server drastically reduces the attack surface.

Another key line of defense involves actively monitoring the use of tools like PowerCat, certutil, and curl on critical servers. While these are legitimate utilities, their execution in certain contexts (for example, on a WSUS server that doesn't normally use them) can be a very clear indication of suspicious activity. EDR solutions and event monitoring systems should generate alerts when they detect anomalous patterns.

At the same time, it is necessary to strengthen detection capabilities against techniques such as DLL side-loading . This includes establishing lists of authorized binaries, reviewing DLL loading paths, using integrity checks, and, where possible, activating protection mechanisms such as Microsoft Defender SmartScreen, Application Control, or equivalents in other security solutions.

Finally, it is highly recommended to conduct regular log reviews, security audits, and incident simulation exercises that include scenarios such as WSUS compromise and the installation of modular backdoors. These exercises help verify whether internal teams are capable of detecting early indicators of an attack and whether response procedures are well-oiled.

Overall, the combination of agile patching, attack surface reduction, behavior-focused monitoring, and response preparedness is what can best curb campaigns like those based on ShadowPad, even against advanced actors who quickly exploit the opportunities provided by new vulnerabilities.

This wave of exploits against WSUS to distribute ShadowPad demonstrates the extent to which centralized management and update services can become high-impact attack vectors if not properly protected. A server that, in theory, is meant to keep the infrastructure secure can end up being the entry point for a silent and persistent intrusion. Understanding the CVE-2025-59287 vulnerability, knowing how ShadowPad works, and adopting robust mitigation measures allows organizations to be much more resilient against these threats, reducing the chances of a single failure becoming a long-term structural problem.