Attackers Hijack WSUS Servers to Deliver Malware via Forged Updates
Researchers have uncovered a novel attack chain that allows adversaries to compromise enterprise endpoints by exploiting Windows Server Update Services (WSUS) to deliver malicious software.
A sophisticated attack chain has been detailed by researchers, enabling adversaries to hijack Windows Server Update Services (WSUS), a critical patch-management architecture widely deployed across enterprise environments. The research, published by SpecterOps, reveals that organizations using WSUS with an external SQL Server database are particularly vulnerable. Attackers with local network access can coerce WSUS server authentication, capture a database session, and then forge malicious updates that domain-joined endpoints will automatically trust and execute.
This attack vector is particularly effective when WSUS deployments separate the update management server from its backend SUSDB database, hosting it on a standalone Microsoft SQL Server instance. When combined with NTLM authentication coercion, this architecture creates a significant exposure. Attackers can leverage tools like PetitPotam to force the WSUS server's computer account to authenticate over SMB to an adversary-controlled host. This authentication is then relayed to the remote SQL Server database using Ntlmrelayx. Since the WSUS computer account possesses permissions to establish a session on the SUSDB instance, this maneuver grants an authenticated database foothold without requiring valid domain user credentials, making it a stealthy entry point.
Once initial database access is obtained via NTLM relaying, the attacker gains the restricted webService role. While this role lacks direct permissions to modify core tables, researchers discovered that the permissions granted to execute specific stored procedures are sufficient to weaponize the update workflow. By chaining native SQL stored procedures such as spImportUpdate, spSaveXmlFragment, spSetBatchURL, spCreateTargetGroup, and spDeployUpdate, an attacker can construct a complete Windows update package containing arbitrary metadata, file hashes, and execution instructions.
This sequence of stored procedure calls allows an attacker to embed valid update metadata directly into the database. Because the database interprets these commands as originating from the trusted WSUS computer account, the forged updates bypass internal validation checks and are subsequently dispatched to targeted endpoint groups. This effectively turns the legitimate update mechanism into a distribution channel for malware.
Under normal circumstances, WSUS mandates that all delivered binaries possess a valid digital signature from a trusted Microsoft certificate and exclusively downloads payloads via the Background Intelligent Transfer Service (BITS) protocol. However, SpecterOps researchers identified a critical logic flaw within the file-verification routine in the Microsoft.UpdateServices.ContentSyncAgent.dll library. The verification logic checks if a payload filename ends with either .txt or .esd. If either extension is detected, the routine skips the digital signature validation entirely. This allows an attacker to rename an executable payload to a file like 'Ghost.txt', host it on a BITS-compliant web server, and trick WSUS into downloading and executing the unverified binary on target endpoints, facilitating unauthenticated code execution.
Furthermore, if an organization's Group Policy is configured to automatically download and schedule update installations, the malicious payload can be deployed without any user interaction. If the payload process is terminated, the malicious update automatically re-executes, ensuring a persistent foothold on the victim host. SpecterOps has released open-source tools, including ludus_wsus for lab environments and NotWSUSpicious for automating the attack chain, to aid security teams in testing and defense.
To mitigate this threat, organizations should enforce Extended Protection for Authentication (EPA) on their SQL database servers hosting SUSDB to block NTLM relaying. Network segmentation is also crucial, restricting database access to only authorized WSUS servers and administrative hosts. Security teams should also strengthen their Security Operations Center (SOC) by monitoring SQL execution logs for anomalous calls to specific stored procedures that might indicate an attempted weaponization of the update workflow.