Weekly threat report on WSUS exploitation, LockBit and ClickFix

At a glance

What this is: This weekly report surveys active exploitation, ransomware evolution, social engineering abuse, and newly disclosed zero-days, with the strongest finding being how quickly techniques move from disclosure to real attacker use.

Why it matters: It matters because security teams responsible for endpoint, identity, cloud, and SOC operations need to prioritise exposure reduction, execution control, and rapid hunting across multiple attack paths rather than treat these as isolated events.

By the numbers:

• Researchers demonstrated 73 zero-days at Pwn2Own Ireland across iPhone 16, Galaxy S25, QNAP and Synology NAS, smart home devices, and WhatsApp.
• CVE-2025-59287 carries a CVSS score of 9.8 and enables unauthenticated remote code execution in WSUS.

👉 Read FireCompass's weekly threat report on new hacking techniques and critical CVEs

Context

This weekly report is really about exposure compression, where public techniques, active exploitation, and commodity tradecraft converge faster than many programmes can absorb them. In practice, that makes attack surface management, endpoint execution control, and privileged access governance part of the same defensive problem. The primary keyword here is cyber threat report, and the report’s value is in showing how quickly multiple attack classes can become operational risk.

The strongest thread is not any single CVE or malware family but the way attackers blend user deception, service exploitation, and post-compromise persistence. That creates a governance problem for security teams that still separate endpoint defence, patching, and identity controls into different workflows. The starting position described in the report is unfortunately typical of modern enterprise exposure, not exceptional.

Key questions

Q: What should security teams do first when a fake update scam can launch PowerShell on user endpoints?

A: First, remove the easiest execution paths. Restrict PowerShell to signed scripts, disable or constrain the Windows Run dialog where feasible, and monitor for browser-to-shell process chains. The goal is to prevent a deceptive prompt from becoming native code execution, especially on endpoints used by privileged staff or support teams.

Q: Why do exposed management services create such a fast exploitation window?

A: Exposed management services are attractive because they often trust incoming input and run with high privilege. If attackers can reach the service directly, they may not need credentials at all, and public proof-of-concept code can turn disclosure into exploitation within hours. Network isolation and rapid patching are both necessary.

Q: What breaks when ransomware targets ESXi, Linux, and Windows at the same time?

A: Recovery becomes harder because the attack is no longer confined to one operating system. When hypervisors, servers, and endpoints are all in scope, a single intrusion can disrupt backups, virtual machines, and administration paths together. That is why restore validation, segmentation, and privilege containment must be tested as one recovery system.

Q: How should teams prioritise vulnerabilities when zero-days and social engineering appear together?

A: Prioritise by reachability, exploitability, and blast radius. A reachable management service or a scam that can execute code on a privileged endpoint deserves faster action than an isolated issue with limited exposure. Combine exposure management with identity controls so the same patching queue also reflects who can execute, administer, or persist.

Technical breakdown

ClickFix fullscreen scams and clipboard hijacking

ClickFix campaigns use a fake fullscreen update screen to create urgency and bypass user caution. The victim is guided into copying and pasting a malicious command, often into Windows Run or PowerShell, which shifts the attack from browser interaction into native code execution. Clipboard hijacking matters because it reduces the effort required from the attacker while making the payload look like routine troubleshooting. Once PowerShell runs, additional stages such as AMSI bypass, obfuscated scripts, and scheduled tasks can establish persistence and evade basic detection.

Practical implication: block or tightly constrain user access to Run and PowerShell execution paths, and alert on browser-to-PowerShell process chains.

WSUS remote code execution and exposed management surfaces

The WSUS issue described in the report is a classic unauthenticated remote code execution path: unsafe deserialization on a management service endpoint leads to code running with SYSTEM-level privileges. When a patch-management service is reachable from the internet, the control failure is not only vulnerability exposure but also architecture. Attackers do not need credentials when the service itself trusts malicious input. Public proof-of-concept weaponisation compresses the time between disclosure and abuse, which raises the value of isolation and service segmentation.

Practical implication: remove WSUS interfaces from internet exposure, segment the service, and hunt for spawned cmd.exe or powershell.exe processes.

LockBit 5.0 and post-compromise ransomware mechanics

LockBit 5.0 reflects an increasingly hybrid ransomware model that targets ESXi, Linux, and Windows while using anti-analysis and process-hollowing techniques to frustrate detection. The operational aim is not just encryption. It is to increase pressure through double extortion, widen the blast radius across virtualised environments, and make recovery harder by attacking the infrastructure layer as well as endpoints. That matters because hypervisor compromise or weak backup validation can turn a single intrusion into a broad service outage.

Practical implication: validate backup restores, harden hypervisors, and monitor for process-hollowing and file-encryption behaviours across mixed environments.

Threat narrative

Attacker objective: The attacker wants fast initial execution, durable persistence, and broad operational leverage through ransomware or credentialed follow-on access.

1. Entry begins with a convincing fullscreen update scam or a public exploit against an exposed management service such as WSUS.
2. Escalation follows when the victim executes malicious PowerShell or the attacker gains SYSTEM-level code execution through unsafe deserialization.
3. Impact occurs when the attacker installs persistence, deploys ransomware, or expands into virtualised infrastructure for double extortion.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Caesars Entertainment Breach 2023 — Scattered Spider — Scattered Spider Okta credential theft enables Caesars Entertainment breach — ransom paid to prevent data release.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attack surface compression is now a governance problem, not just a patching problem. When exploitation, social engineering, and post-exploitation tooling arrive in the same weekly window, the control question changes from "what is vulnerable?" to "what can be reached, executed, and persisted on today?" That is why NIST CSF and CIS Controls need to be operationalised around exposure, identity, and execution pathways together. Practitioners should treat public exploitability as a multi-control event, not a ticket in isolation.

Browser-to-shell abuse is a named concept security teams need to track. ClickFix-style attacks collapse the user interface and the operating system into one deception chain, which means browser security alone is not enough. The important failure mode is trusted user action turning into native command execution with little friction. That intersects with identity governance wherever privileged users, support staff, or admin workstations can translate a single click into elevated runtime behaviour. Practitioners should reduce the opportunity for user-driven code execution to become a privileged endpoint event.

Ransomware resilience now depends on infrastructure privilege containment. LockBit 5.0’s ESXi, Linux, and Windows support shows that the blast radius is increasingly defined by where virtualisation, backup, and admin paths converge. This is where PAM, segmentation, and recovery validation matter together, because the attacker’s real target is service continuity. The defensive lesson is to model ransomware as an access and recovery problem, not only a malware problem. Practitioners should validate whether their recovery path is actually isolated from the attack path.

Zero-day disclosure density is exposing the limits of reactive governance. Seventy-three zero-days at one event is not just a research headline. It is a signal that defenders need continuous exposure management, prioritised by reachability and control failure, rather than waiting for the next quarterly cycle. For identity and access teams, that means the same speed problem applies to privileged accounts, service interfaces, and administrative tooling. Practitioners should align control cadence to disclosure velocity, not policy review calendars.

From our research:

• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%), according to The State of Non-Human Identity Security.
• A separate finding shows that only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, which helps explain why exposure management remains fragile.
• For a broader root-cause view, 52 NHI Breaches Analysis shows how weak lifecycle controls turn access into breach persistence.

What this signals

Exposure management is converging with identity governance. The weekly pattern here is clear: reachable services, privileged endpoints, and rapid exploitability all become identity problems once an attacker can turn access into execution. Teams should align patch prioritisation with administrative privilege, not just CVSS.

Browser-to-shell abuse will keep collapsing traditional endpoint assumptions. When a fake UI can trigger native code execution, the boundary between user action and privileged system behaviour gets blurry. That makes process lineage, execution policy, and admin workstation hardening part of the same control plane.

Attack cadence is now fast enough that quarterly control rhythms are too slow. Security programmes need continuous exposure triage, rapid isolation decisions, and tighter coordination between vulnerability management, SOC, and PAM. The organisations that win here will measure time-to-reachability reduction, not just patch counts.

For practitioners

• Restrict PowerShell execution paths Block or tightly constrain PowerShell on user endpoints, especially where browser content can trigger code execution. Pair that with alerts for browser-to-PowerShell child processes and direct execution from Run or similar launch points.
• Isolate exposed management services Remove WSUS and similar management interfaces from internet exposure, place them in segmented admin networks, and verify that only required hosts can reach them. Treat public reachability as an incident precursor, not a convenience.
• Validate ransomware recovery paths Test restore procedures for ESXi, Linux, Windows, and backup systems together so that recovery does not depend on the same privilege paths an attacker would abuse. Include cloud backup restore checks and monitor for process-hollowing indicators.
• Tighten privileged access on admin workstations Limit who can use elevated tools on systems that manage patching, virtualisation, or identity infrastructure, and review whether support workflows allow a single user action to become SYSTEM-level execution.
• Prioritise exposure by exploitability Rank vulnerabilities by whether they are externally reachable, weaponised, or paired with simple user deception. Focus hunting and remediation on the combinations most likely to move from disclosure to abuse within days, not weeks.

Key takeaways

• This report shows attackers blending social engineering, exploitation, and ransomware into a single weekly pressure cycle.
• The most dangerous pattern is not one technique but the speed at which reachable services and user deception become operational compromise.
• Security teams need to treat exposure reduction, execution control, and privilege containment as one programme rather than separate workstreams.

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Unsafe Deserialization: Unsafe deserialization happens when software reconstructs objects from untrusted data in a way that can trigger code execution or state corruption. In practice, the risk is not the file or message itself, but the fact that the parser is allowed to invoke behaviour while rebuilding the object.
• Process hollowing: Process hollowing is a method where malicious code is placed into a legitimate process after that process is started in a suspended state. The original binary remains present, but its memory is replaced with attacker code, which helps hide the malware from basic file-centric defenses and simple reputation checks.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

What's in the full article

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• More granular breakdowns of the ClickFix tradecraft, including the exact user interaction flow and payload delivery steps
• The specific WSUS exploitation indicators and hunting approach described alongside the CVE-2025-59287 analysis
• Additional detail on LockBit 5.0 tactics across ESXi, Linux, and Windows environments
• The report’s wider weekly threat context, including underground coordination and emerging phishing patterns

👉 FireCompass's full weekly report includes the WSUS, LockBit, ClickFix, and Pwn2Own details behind these findings

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle control. It is suited to practitioners who need a stronger access and governance baseline across modern security programmes.