Skip to content

Back to the catalog

Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?
huntress.comwriteup

Velociraptor WSUS Exploitation, Pt. I: WSUS-Up?

A Huntress blog post (part one of a series) describing how Velociraptor, a DFIR/endpoint forensics and hunting tool, can be misused alongside WSUS (Windows Server Update Services) for offensive purposes, such as living-off-the-land style abuse or lateral movement. The fetched content only contained site navigation, not the article body, so specific technical details (exploitation steps, payloads, detection guidance) could not be confirmed.

TL;DR Huntress research on abusing Velociraptor with WSUS for offensive tradecraft — full article text unavailable from fetch.
Open original ↗
Document

What it is

A Huntress incident report (part one of two) describing a real November 12, 2025 intrusion where threat actors exploited CVE-2025-59287, a deserialization-based remote code execution flaw in Windows Server Update Services (WSUS), then installed Velociraptor — a legitimate open-source DFIR tool — to use as command-and-control for the compromised endpoint. Microsoft released a patch on October 23, 2025.

How it works

The chain, as observed in Windows Event Logs:

  1. WSUS RCE via CVE-2025-59287 compromises WSUSService.exe (the flaw has been exploited against public-facing WSUS instances on default ports).
  2. The actor runs Windows Installer to fetch a malicious MSI (https://s3.wasabisys.com/kiessler/v4.msi) from s3[.]wasabisys[.]com.
  3. Velociraptor is installed as a LocalSystem auto-start service (Velociraptor Service), configured to beacon to update[.]githubtestbak[.]workers[.]dev.
  4. Base64-encoded PowerShell commands spawn as child processes of Velociraptor.exe, running discovery (net group "domain computers", quser, setspn -Q VeeamBackupSVC/*, ipconfig /al).

Notably, the install command ran three times (one success, two repeat attempts) from the same location.

Preconditions / Affected

Publicly exposed, unpatched WSUS instances on default ports. This is distinct from other recent Velociraptor abuse: Cisco Talos attributed October activity (medium confidence) to Storm-2603 via SharePoint "ToolShell" vulnerabilities — Huntress does not attribute this WSUS incident to a named actor.

What to do

  • Patch WSUS (Microsoft update available October 23, 2025) and remove WSUS exposure on default ports from the public internet.
  • Hunt for the IOCs: MSI from s3[.]wasabisys[.]com (kiessler/v4.msi), and Velociraptor C2 update[.]githubtestbak[.]workers[.]dev.
  • Alert on Velociraptor as an unexpected installed service (Service Control Manager/7045 naming Velociraptor.exe --config ... service run), especially where not sanctioned by your own DFIR team.
  • Detect PowerShell spawned as a child of Velociraptor.exe, particularly -ExecutionPolicy Unrestricted -encodedCommand.
  • Correlate WSUSService.exe → Windows Installer (SCM/7036 "Windows Installer, running") → MSI fetch as an exploitation signature.

Caveats

This is part one; the broader pattern and evolution of Velociraptor abuse is deferred to part two. The initial-access vector here is confirmed (WSUS), unlike the Talos/Storm-2603 case which was inferred. No hashes are given for the MSI — pivot on the domains and service/process behavior. Attribution for this specific incident is not stated.

Organisations named here

  • WSUS

CVEs named here

  • CVE-2025-59287

Technologies named here

  • Windows Server Update Services
  • Velociraptor
  • SharePoint
  • Cobalt Strike
  • Mimikatz
  • Metasploit
  • PowerSploit
  • VirusTotal
  • PowerShell
  • WSUS

Techniques named here

  • Exploitation of public-facing application
  • Malicious MSI installation via compromised service
  • Abuse of legitimate DFIR tool for C2
  • Encoded PowerShell command execution
  • Discovery

Threat actors named here

  • Storm-2603
  • Unattributed threat actor

Related in Offensive Security