Attackers deliver ShadowPad via newly patched WSUS RCE bug

Securityaffairs.Co •Pierluigi Paganini • November 24, 2025

Attackers exploited a patched WSUS flaw (CVE-2025-59287) to gain access, use PowerCat for a shell, and deploy the ShadowPad malware. AhnLab SEcurity intelligence Center (ASEC) researchers reported that threat actors exploited a recently patched WSUS flaw (CVE-2025-59287) to deliver the ShadowPad malware. ShadowPad is a backdoor widely used by China-linked APT groups and privately sold […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ShadowPad Malware Exploits WSUS Vulnerability for System Access Attackers exploited a critical vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287, to deploy ShadowPad malware. This backdoor, associated with China-linked APT groups, allows for full system access. Microsoft issued an emergency patch on November 21, 2025, to address this security flaw. 2 sources 33

Extracted Entities

Attackers deliver ShadowPad via newly patched WSUS RCE bug

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Malware (1)

Platforms (1)

Tools (1)