Back Asec.Ahnlab

Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287)

Asec.Ahnlab •ATCP • November 18, 2025

1. Overview AhnLab SEcurity intelligence Center (ASEC) has identified an attack where the remote code execution vulnerability in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, was exploited to distribute the ShadowPad malware. ShadowPad is a backdoor malware used by numerous Chinese APT groups. First discovered in 2017, its developers have continuously updated its […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation A critical vulnerability in FortiWeb Web Application Firewall (WAF) has been actively exploited, allowing attackers to gain full administrative access to affected systems. Organizations using FortiWeb are at risk of total control being seized by malicious actors. The flaw has been confirmed to be exploited in the wild, prompting urgent attention from cybersecurity teams. 100 sources 80

Extracted Entities

Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287)

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Malware (1)