ShadowPad Malware Exploits WSUS Vulnerability for System Access

First seen 24 Nov 2025, 22:26 UTC • Itsecuritynews.Info

•33

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Attackers exploited a critical vulnerability in Windows Server Update Services (WSUS), identified as CVE-2025-59287, to deploy ShadowPad malware. This backdoor, associated with China-linked APT groups, allows for full system access. Microsoft issued an emergency patch on November 21, 2025, to address this security flaw.

How this analysis works

Attack Flow

Continue Reading

China-linked Cyber Group Expands Targeting to Southeastern Europe China-Nexus APT UAT-7290 Targets South Asia Telecoms in Cyber Espionage Campaign China-linked UAT-7290 Targets Telcos in Cyberespionage Campaign UAT-7290 Cyber Espionage Targets South Asian Telecoms SHADOW-EARTH-053 Exploits Microsoft Exchange Vulnerabilities in Asia FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation

ShadowPad Malware Exploits WSUS Vulnerability for System Access

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading