WSUS RCE flaw abused with Velociraptor abuse
JSAC2026 Day 2 detailed active exploitation of the WSUS RCE flaw (CVE-2025-59287), a Japan-targeting CoGUI phishing-as-a-service platform, RapperBot's IoT botnet, and Qilin ransomware's attack lifecycle.
Sourceblogs.jpcert.or.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-59287 as exploited in the wild.
JPCERT/CC's JSAC2026 Day 2 recap covered a range of research spanning forensics tooling and active intrusion cases affecting Japanese organizations. Researchers detailed a real incident in which attackers exploited the WSUS remote-code-execution vulnerability (CVE-2025-59287) for initial access against a Japanese company, then abused the legitimate forensic tool Velociraptor as a remote-management/C2 mechanism, deploying it via an MSI installer. Correlation of Velociraptor configuration files, PKI structures, hosting domains, and AWS account names across multiple incidents allowed analysts to attribute several intrusions to the same actor.
Separately, two presentations dissected the China-based CoGUI phishing kit and the Phishing-as-a-Service platform FishingMaster (垂钓大师), which powers large-scale phishing campaigns impersonating Japanese financial, transportation, and government-service brands. After 2025 media exposure the operators rebranded as NX and FA while hardening infrastructure concealment and encryption. A related talk on phishing admin panel construction showed that PhaaS operators (including CoGUI and Oriental Gudgeon) rely on Docker-based rapid deployment and a limited pool of dependent domains/URLs, suggesting takedown of admin panels rather than individual sites as a more effective defense.
Other talks covered RapperBot, an IoT DDoS botnet targeting DVRs/cameras with large infection populations in Taiwan, the US, and Japan, whose C2 activity was linked to March 2025 disruptions on X and attacks on Chinese gaming servers before its operator's arrest; a Silver Fox malspam campaign (Sept–Oct 2025) delivering ValleyRAT and VShell via multi-stage loaders to Japanese targets, marking an apparent expansion beyond its usual China/Taiwan focus; and an overview of Qilin ransomware's attack lifecycle in Japan, where SMEs made up over half of 2025 victims, with initial access via leaked credentials from Telegram/Signal and IABs followed by rapid RMM abuse, exfiltration, and automated encryption of virtual environments.
Mentioned in this report
Source reporting: https://blogs.jpcert.or.jp/en/2026/02/jsac2026day2.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs, actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs