NotWSUSpicious: Weaponizing Windows Update Infrastructure

At Black Hat USA 2026, SpecterOps researcher Beyviel David presented a new Attack Path technique in the talk “Turning Enterprise Update Servers Into Backdoor Factories.” Under certain conditions, the technique can turn enterprise WSUS infrastructure into a mechanism for lateral movement, persistence, and code deployment across Windows systems. A series of research articles on the SpecterOps blog provides a detailed technical breakdown of the technique.

Key attack conditions: WSUS must use an external MSSQL server, and Extended Protection for Authentication (EPA) must not be required on that server. coerce authentication from the WSUS computer account and relay the NTLM authentication to MSSQL, establishing a SQL session as the WSUS computer account. The WSUS computer account does not have direct SELECT, UPDATE, or DELETE permissions on the SUSDB tables. However, its webService role allows it to execute WSUS stored procedures. This is sufficient to create a custom update, create a Target Group, add a specific computer to that group, and deploy the update to it.

Bypassing Signature Verification WSUS normally requires executable update files to be digitally signed. Analysis of Microsoft.UpdateServices.ContentSyncAgent.dll showed that the VerifyFile function skips CheckCertificateSignature if the filename ends in .txt or .esd. In the initial demonstration, the author used Ghost.txt; the later NotWSUSpicious example uses the double extension Specter.exe.txt. After installing the custom update, the researcher received a C2 callback.

Delivery via BITS The payload URL is configured through spSetBatchURL. WSUS then downloads the update file using Background Intelligent Transfer Service (BITS), which requires the hosting web server to support HTTP Range requests. The author implemented a Python server with the required support and included it in NotWSUSpicious as BitsWebServer.py.

Automatic Installation and Persistence If Configure Automatic Updates → 4 - Auto download and schedule install is enabled via GPO, the custom update can be installed without user interaction. The author also observed that after the C2 process exits, the update is immediately redeployed, allowing the mechanism to be used for persistence. However, this results in an update failure being displayed in the client's Windows Update settings.

The author released NotWSUSpicious, a Python tool that calculates the payload's size and SHA-1/SHA-256 hashes and generates the SQL queries required to create and deploy a custom update to a selected machine. A WSUS Ludus Lab was also released. It automatically deploys a WSUS server configured to use external MSSQL, client machines, and the required Group Policy configuration. By default, the lab uses option 4, meaning that clients automatically install updates.

For mitigation, SpecterOps recommends requiring EPA on the WSUS database server, restricting network access to the database server to the WSUS server and administrative locations, and monitoring suspicious execution of spCreateTargetGroups, spSetBatchURL, and spDeployUpdate.

PoC (tool): https://github.com/bagelByt3s/NotWSUSpicious

Article (part 1): https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-1 Article (part 2): https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-2 Article (tool): https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious Article (lab): https://specterops.io/blog/2026/08/05/built-a-wsus-ludus-lab