A lately patched security flaw in Microsoft Home windows Server Replace Providers (WSUS) has been exploited by menace actors to distribute malware generally known as ShadowPad.
“The attacker focused Home windows Servers with WSUS enabled, exploiting CVE-2025-59287 for preliminary entry,” AhnLab Safety Intelligence Heart (ASEC) stated in a report printed final week. “They then used PowerCat, an open-source PowerShell-based Netcat utility, to acquire a system shell (CMD). Subsequently, they downloaded and put in ShadowPad utilizing certutil and curl.”
ShadowPad, assessed to be a successor to PlugX, is a modular backdoor broadly utilized by Chinese language state-sponsored hacking teams. It first emerged in 2015. In an evaluation printed in August 2021, SentinelOne referred to as it a “masterpiece of privately offered malware in Chinese language espionage.”
CVE-2025-59287, addressed by Microsoft final month, refers to a crucial deserialization flaw in WSUS that may very well be exploited to realize distant code execution with system privileges. The vulnerability has since come underneath heavy exploitation, with menace actors utilizing it to acquire preliminary entry to publicly uncovered WSUS cases, conduct reconnaissance, and even drop authentic instruments like Velociraptor.
 |
|
ShadowPad put in by way of CVE-2025-59287 exploit |
Within the assault documented by the South Korean cybersecurity firm, the attackers have been discovered to weaponize the vulnerability to launch Home windows utilities like “curl.exe” and “certutil.exe,” to contact an exterior server (“149.28.78[.]189:42306”) to obtain and set up ShadowPad.
ShadowPad, much like PlugX, is launched by the use of DLL side-loading, leveraging a authentic binary (“ETDCtrlHelper.exe”) to execute a DLL payload (“ETDApix.dll”), which serves as a memory-resident loader to execute the backdoor.
As soon as put in, the malware is designed to launch a core module that is answerable for loading different plugins embedded within the shellcode into reminiscence. It additionally comes fitted with a wide range of anti-detection and persistence strategies.
“After the proof-of-concept (PoC) exploit code for the vulnerability was publicly launched, attackers rapidly weaponized it to distribute ShadowPad malware by way of WSUS servers,” AhnLab stated. “This vulnerability is crucial as a result of it permits distant code execution with system-level permission, considerably growing the potential impression.”
