ShadowPad Malware Leverages New WSUS Flaw for Full-System Compromise (2025)
In November 2025, attackers leveraged a recently patched WSUS vulnerability (CVE-2025-59287) to compromise Windows Servers and distribute ShadowPad malware. According to the AhnLab Security Intelligence Center, the threat actors exploited misconfigurations in Windows Server Update Services to gain initial access, then deployed the open-source PowerCat tool to establish remote control and facilitate lateral movement. This campaign targeted enterprises relying on WSUS for patch management, allowing attackers to achieve persistent, full-system access and exfiltrate sensitive operational data. This incident underscores the growing threat of sophisticated supply chain attacks that exploit ubiquitous IT infrastructure and patched vulnerabilities. It highlights the urgent need for continuous visibility, proactive patch management, and comprehensive zero trust strategies across data centers and cloud environments.
Kill Chain
