Hackers can leverage WSUS servers to deliver malware and compromise enterprise endpoints. Spread the love August 6, 2026 A novel attack chain that allows adversaries to hijack Windows Server Update Services (WSUS), the trusted patch-management architecture widely deployed across enterprise environments. The research, published by SpecterOps researcher Beyviel David, demonstrates how organizations hosting WSUS on an external SQL Server database face a critical operational risk: attackers with local network access can coerce authentication, capture a database session, and mint malicious "updates" that domain-joined endpoints trust and execute automatically. Windows Server Update Services into backdoors. Enterprise WSUS deployments frequently separate the update management server from its backend storage, hosting the SUSDB database on a standalone Microsoft SQL Server instance rather than using the default Windows Internal Database. This architecture creates an exposure vector when combined with NTLM authentication coercion. Using tools such as PetitPotam, an attacker can force the WSUS server's computer account to authenticate over SMB to a host controlled by the adversary. The attacker then relays this authentication directly to the remote SQL Server database using Ntlmrelayx. Because the WSUS computer account possesses permissions to establish a session on the SUSDB instance, this maneuver grants an authenticated database foothold without requiring valid domain user credentials. Maintaining visibility over these relay vectors is critical for preserving Active Directory security across corporate networks. Initial database access obtained via NTLM relaying places the attacker in the restricted webService role, which lacks direct SELECT, UPDATE, or DELETE permissions on core tables. However, researchers discovered that the permissions granted to execute specific stored procedures provide sufficient control to weaponize the update workflow. By methodically chaining native SQL stored procedures - including spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, and spDeployUpdate an attacker can forge a complete Windows update package containing arbitrary metadata, file hashes, and execution instructions. As detailed in the SpecterOps research report, this stored-procedure sequence allows an attacker to assemble valid update metadata directly inside the database. Because the database interprets these commands as coming from the trusted WSUS computer account, the forged updates pass internal validation and are dispatched to targeted endpoint groups. Securing update infrastructure is an essential component of overall Windows server security management. Under normal operating conditions, WSUS requires that all delivered binaries carry a valid digital signature from a trusted Microsoft certificate, downloading payloads exclusively via the Background Intelligent Transfer Service (BITS) protocol. SpecterOps researchers reverse-engineered the Microsoft.UpdateServices.ContentSyncAgent.dll library using dnSpy and identified a logic flaw inside the file-verification routine: * File Extension Check: The verification logic checks whether a payload filename ends in .txt or .esd. * Bypass Trigger: If either extension is detected, the routine skips digital signature validation entirely. An attacker can rename an executable payload to a name such as Ghost.txt, host it on a BITS-compliant web server, and trigger WSUS to download and execute the unverified binary on target endpoints. This flaw facilitates unauthenticated code execution across client machines. Furthermore, if the target environment's Group Policy is configured to automatically download and schedule update installations, the payload deploys without user interaction. If the payload process is terminated, the malicious update automatically re-executes, establishing a persistent foothold on the victim host. SpecterOps released two open-source projects to assist security teams: * ludus_wsus: An Ansible-based lab environment for deploying vulnerable WSUS instances for testing. * NotWSUSpicious: A Python utility that automates SQL stored-procedure chaining, bundled with a custom BITS server and a modified mssqlclient.py. * Enforce Extended Protection for Authentication (EPA): Enable EPA on the SQL database server hosting SUSDB to block NTLM relaying. * Network Segmentation: Restrict database network access so only authorized WSUS servers and administrative management hosts can connect. * Monitor Stored Procedure Invocations: Audit SQL execution logs for anomalous calls to spCreateTargetGroup, spDeployUpdate, or spSetBatchURL references involving .txt or .esd files. Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. A proof-of-concept (PoC) exploit has been released for a critical vulnerability in Microsoft's Windows Server Update Services (WSUS), enabling unauthenticated attackers to execute remote code with SYSTEM privileges on affected servers. Dubbed CVE-2025-59287 and assigned a CVSS v3.1 score of 9.8, the flaw stems from unsafe deserialization of untrusted data... October 20, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com" Hackers are actively exploiting a critical flaw in Microsoft's Windows Server Update Services (WSUS), with security researchers reporting widespread attempts in the wild. The vulnerability, tracked as CVE-2025-59287, allows remote code execution on unpatched WSUS servers, potentially granting attackers full control over enterprise networks. As of October 27, 2025, firms... October 27, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com" In a recent setback for Windows administrators, Microsoft's October 2025 security update addressing a critical vulnerability in Windows Server Update Services (WSUS) has inadvertently broken hotpatching functionality on a subset of Windows Server 2025 systems. The flaw, tracked as CVE-2025-59287, allows remote code execution in WSUS environments, posing significant risks... November 3, 2025 In "Cybersecurity News - Original News Source is cybersecuritynews.com"

Introducing the SpecterOps Tradecraft Academy. Jul 21, 2026 Put Insights Into Action TL;DR: SpecterOps Tradecraft Academy is now live at academy.specterops.io, offering free, on-demand courses built by SpecterOps: BloodHound Basics, Software Supply Chain Security for Red Teamers, and Kubernetes for Red Teamers, with adversary tradecraft for AI and LLMs coming soon! SpecterOps was built on the idea that a deep understanding of adversary tradecraft is the most effective way to meaningfully defend against it. That belief shaped its services, drove the research that gave rise to tools like BloodHound, and made training a core pillar of what SpecterOps Inc. do. Its Adversary Tactics and Adversary Perspectives series of courses distill what SpecterOps Inc. learn on real engagements into structured, hands-on curriculum with immersive labs that SpecterOps Inc. can share in live classes across the world. These courses are deeply technical and hands-on, built for practitioners ready to develop real depth in offensive and defensive tradecraft. They're taught by the Specters doing the work daily, and students learn in a shared environment where they work through labs alongside one another, often as a team. Designing and delivering courses of this depth takes time to do right. But not every attack path, technique, tool, or lesson drawn from emerging technologies calls for a week-long course in a physical (or virtual) setting. Some of the most valuable tradecraft its teams develop lends itself to a faster and more flexible format than SpecterOps Inc. has historically offered. That's why I'm excited to share that today SpecterOps Inc. is launching the SpecterOps Tradecraft Academy, its new on-demand training platform, now live at academy.specterops.io. The Tradecraft Academy reflects the same commitment to transparency that drives its research, tools, and community contributions. It's built to share what SpecterOps Inc. is learning in the field in a flexible format security practitioners can access on their own schedule and apply quickly. What's available now. These courses are live today for free, each built by SpecterOps consultants and researchers: * BloodHound Basics, built by Jean-Damien Douillard, takes you from first login to capable operator across both BloodHound Community Edition and BloodHound Enterprise. This course covers installation, data collection with SharpHound and AzureHound, ingestion, data exploration, and graph analysis across Active Directory, Entra, and Azure environments. The course also covers Cypher querying, API usage, OpenGraph extensions, administration, and how to interpret findings and remediation plans. * Software Supply Chain Security for Red Teamers, built by Kieran Croucher and Andrew Luke, connects fundamental software supply chain concepts, real-world case studies, and modern defensive frameworks to help red teamers and defenders understand how supply chain attacks happen and how to emulate or defend against them - combining conceptual depth with hands-on labs to build practical foundation in an urgent and important discipline. * Kubernetes for Red Teamers, built by Alex Rodriguez, Hector Riestra, and Hunter Orrantia, teaches Kubernetes attack paths through a progression of core security concepts and hands-on lab scenarios. You'll learn why each transition works as you move through deeper layers of access, identity, and control, applying concepts that explain lateral movement, privilege escalation, and broader cluster compromise. By the end, you'll be better prepared to evaluate a cluster's security posture and leave with a working lab environment built for continued research and practice. What's coming next. This is the first step in a broader on-demand training experience from SpecterOps, one that complements its live training offerings and expands the ways practitioners can develop and deepen their adversary tradecraft knowledge. New content and specialized tracks will roll out over time, with the goal of keeping the curriculum in lockstep with its services, research, and product work. As technologies expand, techniques evolve, and attack paths emerge, SpecterOps Inc. aim to quickly turn those insights into accessible training. That includes upcoming content on red team tradecraft for platforms like AWS and macOS, alongside the next course in the queue, Adversary Intelligence: LLM Tradecraft. See it live at Black Hat USA. Come find SpecterOps Inc. at the Kennel Club at Black Hat USA, where practitioners from SpecterOps, OpenAI, and the UK AI Security Institute will be giving talks, running live Tradecraft Academy workshops, and be on hand for discussion. See everything planned at specterops.io/black-hat. Vice President of Tradecraft Andrew Chiles is the Vice President of Tradecraft at SpecterOps and leads teams specializing in tradecraft research, capability development, and training.