Unraveling the WSUS Exploit Chain

A financially motivated, China-nexus threat actor known as DragonClover exploited a critical WSUS vulnerability (CVE-2025-59287) to achieve remote code execution, abuse legitimate tools like Velociraptor for persistent access, and deploy a range of post-exploitation payloads across multiple global campaigns.