Chinese Hackers Exploiting WSUS Remote Code Execution Vulnerability to Deploy ShadowPad Malware

Gbhackers •Mayura Kathir • November 21, 2025

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese Hackers Target WSUS Vulnerability to Distribute ShadowPad Malware Chinese hackers are exploiting a remote code execution vulnerability in Windows Server Update Services (WSUS) to deploy ShadowPad malware. This attack affects organizations using WSUS for patch management, potentially compromising sensitive data and systems. The exploitation of this vulnerability highlights the ongoing threat posed by advanced persistent threat (APT) groups. 2 sources 49

Extracted Entities

Chinese Hackers Exploiting WSUS Remote Code Execution Vulnerability to Deploy ShadowPad Malware

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Vulnerabilities (2)