SHADOWPAD MALWARE ACTIVELY EXPLOITS WSUS VULNERABILITY FOR FULL SYSTEM ACCESS

Summary from the TLDR InfoSec newsletter

Threat actors are actively exploiting CVE-2025-59287, a critical deserialization RCE flaw in Microsoft WSUS (patched last month), to deploy ShadowPad malware with SYSTEM privileges. The attack chain uses PowerCat for initial shell access, then certutil/curl to download ShadowPad, which persists via DLL side-loading through a legitimate ELAN binary (ETDCtrlHelper.exe). Exploitation accelerated after public PoC release. Patch immediately and audit WSUS exposure.