Windows Server flaw targeted by hackers to spread malware - here's what we know

Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.

• Chinese state-sponsored actors are exploiting CVE-2025-59287, a critical WSUS flaw enabling unauthenticated RCE with SYSTEM privileges
• AhnLab reports attackers using PowerCat and certutil/curl to deploy ShadowPad, a PlugX successor backdoor
• Likely targets include government, defense, telecom, and critical infrastructure sectors

Chinese state-sponsored threat actors are reportedly actively exploiting a vulnerability in the Microsoft Windows Server Update Services (WSUS), to spread malware, experts have warned.