{"podcast":{"title":"Threat Talks - Your Gateway to Cybersecurity Insights","slug":"threat-talks-your-gateway-to-cybersecurity-insights-6755159","podcast_index_feed_id":6755159,"rss_url":"https://feeds.transistor.fm/threat-talks-your-gateway-to-cybersecurity-insights","website_url":"https://threat-talks.com/","image_url":"https://img.transistorcdn.com/wqPeh6mA2wCORVwUDSv8RSIWcuUMzTZP0kjjqamexmc/rs:fill:0:0:1/w:1400/h:1400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8xN2Q1/NGE1NjBhYWY0ZmY5/NzEyODA5OGU3NDdi/MmNmYi5qcGc.jpg","author":"Threat Talks","episode_count":126,"summary":"Threat Talks is your cybersecurity knowledge hub. Unpack the latest threats and explore industry trends with top experts as they break down the complexities of cyber threats. We make complex cybersecurity topics accessible and engaging for everyone, from IT professionals to every day internet users by providing in-depth and first-hand experiences from leading cybersecurity professionals. Join us for monthly deep dives into the dynamic world of cybersecurity, so you can stay informed, and stay secure!","last_synced_at":"2026-06-09T18:17:54.349616+00:00","page_url":"https://stenobird.com/podcast/threat-talks-your-gateway-to-cybersecurity-insights-6755159"},"episode":{"title":"WSUS RCE: Update Weaponized","slug":"wsus-rce-update-weaponized","published_at":"2025-12-16T09:03:47+00:00","page_url":"https://stenobird.com/podcast/threat-talks-your-gateway-to-cybersecurity-insights-6755159/wsus-rce-update-weaponized","show_page_url":"https://stenobird.com/podcast/threat-talks-your-gateway-to-cybersecurity-insights-6755159","url":"https://share.transistor.fm/s/a5b84931","audio_url":"https://2.gum.fm/op3.dev/e/pdcn.co/e/pscrb.fm/rss/p/pdst.fm/e/dts.podtrac.com/redirect.mp3/media.transistor.fm/a5b84931/7888f5f1.mp3","summary":"Attackers are abusing a WSUS flaw - Microsoft’s Windows Server Update Services - to detonate PowerCat, spawn reverse shells, and plant ShadowPad. All from the update server your entire Windows estate trusts by default. One weak crypto key and a broken deserialization function let attackers hit your WSUS server with unauthenticated SYSTEM-level code execution. Chinese APT groups are already exploiting it to drop malware in memory, blend into legitimate WSUS traffic, and pivot deeper into the network. Yes WSUS patch exists, but even if you patch it today, the real problem remains: Your WSUS server is a high-value target with high-trust pathways - and most environments expose it far more than they think. Watch host Lieuwe Jan Koning - with Blue Team expert Rob Maas and Red Team lead Luca Cipriano - break down how the exploit works, how attackers chain it into real-world intrusions, and the Zero Trust fixes that actually matter. (00:00) - Intro (01:03) - What is a WSUS server? (02:48) - The WSUS vulnerability (05:49) - What is deserialization? (08:17) - What to do about this vulnerability (10:52) - How attackers are exploiting it (18:42) - Real-world harm (19:16) - Final advice & defense strategy Key Topics Covered • How one WSUS flaw enables unauthenticated RCE as SYSTEM • The attack chain: crafted payload → deserialization → PowerCat → ShadowPad • Why update servers are high-value pivot points for APT groups • How Chinese APTs weaponized this vulnerability in real-world intrusions • Zero Trust protections: segmentation, egress control, EDR/XDR detection • How to secure Microsoft Windows Server Update Services (WSUS patching best practices) Episodes Mentioned • China Nexus Barracuda Hack: https://www.youtube.com/watch?v=4X9AmBhOmSA • APT Sand Eagle: https://youtu.be/U…","meta_description":"Attackers are abusing a WSUS flaw - Microsoft’s Windows Server Update Services - to detonate PowerCat, spawn reverse shells, and plant ShadowPad. All from…","key_points":[],"chapters":[],"topics":[],"duration_seconds":1377,"processing_state":"not_requested","actions":[{"name":"request_transcript","method":"POST","url":"https://stenobird.com/v1/public/podcasts/threat-talks-your-gateway-to-cybersecurity-insights-6755159/episodes/wsus-rce-update-weaponized/transcription-requests","description":"Idempotently request low-priority transcript generation for this episode."},{"name":"read_markdown","method":"GET","url":"https://stenobird.com/podcast/threat-talks-your-gateway-to-cybersecurity-insights-6755159/wsus-rce-update-weaponized.md","description":"Read the agent-friendly Markdown representation of this episode resource."}]}}