AhnLab Security Intelligence Center (ASEC) has uncovered a cyberattack exploiting a newly disclosed remote code execution (RCE) flaw in Microsoft Windows Server Update Services (WSUS), tracked as CVE-2025-59287, to distribute the ShadowPad backdoor.
The advanced backdoor, first discovered in 2017, has been used by multiple Chinese state-linked threat actors for espionage operations.
According to research by SentinelOne, ShadowPad is sold privately to Chinese advanced persistent threat (APT) groups and is frequently updated with modular components for stealth and persistence.
Exploitation of CVE-2025-59287 and Initial Foothold
The attack targets Windows Servers running WSUS, a service used to manage Windows updates in enterprise networks. Microsoft disclosed the vulnerability on October 14, 2025, describing it as a critical RCE bug that allows remote attackers to execute arbitrary code with system-level privileges.
After proof-of-concept (PoC) exploit code became public on October 22, ASEC’s telemetry recorded PowerShell executions consistent with exploitation attempts.
Threat actors leveraged PowerCat, a PowerShell-based open-source alternative to Netcat, to establish an interactive command shell on compromised servers.
The observed command downloaded PowerCat from GitHub and connected to a remote command-and-control (C2) IP address (154.17.26[.]41) on port 8080, giving the attacker complete control of the host.
ShadowPad Deployment and Persistence
After gaining initial access, the attackers executed additional commands on November 6 using built-in Windows utilities curl.exe and certutil.exe to download and decode payloads from a remote server (149.28.78[.]189:42306).
This multi-stage infection sequence installed ShadowPad through DLL sideloading a common technique used to disguise malicious components as legitimate software libraries.
In this case, the legitimate executable ETDCtrlHelper.exe loaded a malicious DLL named ETDApix.dll, which acted as the loader for ShadowPad’s encrypted core. The decrypted content, stored as 0C137A80.tmp, contained the backdoor’s configuration data.
ShadowPad was configured with the mutex and service name “Q-X64,” designed to maintain persistence via registry and scheduled tasks under typical Windows system paths such as %ProgramFiles% and %APPDATA%.
The malware communicated with its command-and-control server through HTTP and HTTPS on 163.61.102[.]245:443, using custom headers that mimicked legitimate browser traffic to evade detection.
It also injected into Windows processes like WinMail.exe, wmplayer.exe, and svchost.exe to obscure its presence.
Security teams are urged to apply Microsoft’s latest patch for CVE-2025-59287 immediately. Organizations running WSUS should restrict access so that only Microsoft Update servers can connect and block TCP ports 8530 and 8531 from untrusted sources.
Administrators should also audit PowerShell, curl, and certutil execution logs and monitor for unusual outbound network activity to detect potential ShadowPad infections.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
 has uncovered a cyberattack exploiting a newly disclosed remote code execution){kind=link}