Analysis of ShadowPad Attack Exploiting WSUS Remote Code Execution Vulnerability (CVE-2025-59287)

AhnLab ASEC observed active exploitation of WSUS RCE (CVE-2025-59287) after public PoC release, where attackers used PowerCat to gain a CMD shell and then leveraged curl/certutil to download and install the ShadowPad backdoor. The report includes ShadowPad DLL sideloading details, configuration values, file and MD5 indicators, C2 addresses, and recommended mitigations (apply Microsoft update, restrict WSUS access, audit PowerShell/certutil/curl activity).