{"cve_id":"CVE-2025-59287","title":"Windows Server Update Service - Insecure Deserialization","severity":"critical","actively_exploited":true,"patterns":["/SimpleAuthWebService/SimpleAuth.asmx","/ClientWebService/Client.asmx","/ReportingWebService/ReportingWebService.asmx"],"events":855,"unique_ips":262,"actors":[{"ip":"65.49.1.132","events":21,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-69-00.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.182","events":18,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-74-00.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.24","events":16,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-53a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.142","events":16,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-70-00.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"74.82.47.3","events":16,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-10.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.192","events":15,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-87-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.10","events":15,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-52a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"216.218.206.67","events":14,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-06.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.20.68","events":13,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-19.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.38","events":13,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-62-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"216.218.206.66","events":13,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-05.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.20.69","events":13,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-20.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"184.105.139.67","events":13,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-01.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.20.67","events":13,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-18.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"65.49.1.38","events":12,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-54a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.80","events":12,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-57a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"74.82.47.5","events":12,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-12.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.108","events":12,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-67-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.202","events":12,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-88-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.24","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-61-0.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"64.62.156.80","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-65-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.94","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-66-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.94","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-58a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"74.82.47.2","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-09.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"74.82.47.4","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-11.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.20.66","events":11,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-17.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.162","events":10,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-84-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.172","events":10,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-73-00.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"65.49.1.232","events":10,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-79-00.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"64.62.156.142","events":10,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-82-0.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"64.62.156.122","events":10,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-80-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.108","events":10,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-59a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.202","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-76-00.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"64.62.156.212","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-89-0.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"216.218.206.68","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-07.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.152","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-83-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"184.105.247.194","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-13.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"64.62.156.172","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-85-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"184.105.139.68","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-02.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.152","events":9,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-71-00.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"184.105.247.254","events":8,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-13o.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"185.218.138.31","events":8,"country_code":"US","country":"United States","org":"","rdns":"","scanner_tag":null},{"ip":"64.62.156.132","events":8,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-81-0.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.222","events":8,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-78-00.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"184.105.247.196","events":7,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-15.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"184.105.247.195","events":7,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-14.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"184.105.139.70","events":7,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-04.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.162","events":7,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-72-00.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}},{"ip":"65.49.1.192","events":7,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-75-00.shadowserver.io","scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"hosting_provider","url":""}},{"ip":"64.62.197.197","events":6,"country_code":"US","country":"United States","org":"Hurricane Electric LLC","rdns":"scan-50a.shadowserver.org","scanner_tag":{"key":"shadowserver","label":"Shadowserver","category":"research","url":"https://www.shadowserver.org/"}}],"top_asns":[{"asn":6939,"org":"Hurricane Electric LLC","events":650,"ips":75},{"asn":8075,"org":"Microsoft Corporation","events":193,"ips":183},{"asn":215929,"org":"Data Campus Limited","events":2,"ips":1},{"asn":205463,"org":"Pembe Gul Isguzar Karagoz","events":1,"ips":1},{"asn":135377,"org":"UCLOUD INFORMATION TECHNOLOGY HK LIMITED","events":1,"ips":1}],"fingerprints":{"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0700_cc7b97fea909","ge11nn0500_2d30dc89d981","po11nn0800_a72b3532d8b7"],"ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i250900_b78ed14e2fd0_e7c285222651"]},"sample_paths":["/ClientWebService/Client.asmx?wsdl","/ClientWebService/Client.asmx?singleWsdl","/SimpleAuthWebService/SimpleAuth.asmx","/ClientWebService/Client.asmx","/ReportingWebService/ReportingWebService.asmx"],"timeline":[{"day":"2026-04-29","events":3,"ips":3},{"day":"2026-04-30","events":3,"ips":3},{"day":"2026-05-01","events":3,"ips":3},{"day":"2026-05-02","events":3,"ips":3},{"day":"2026-05-03","events":2,"ips":2},{"day":"2026-05-04","events":7,"ips":7},{"day":"2026-05-05","events":9,"ips":8},{"day":"2026-05-06","events":8,"ips":8},{"day":"2026-05-07","events":9,"ips":8},{"day":"2026-05-08","events":21,"ips":19},{"day":"2026-05-09","events":8,"ips":7},{"day":"2026-05-10","events":8,"ips":7},{"day":"2026-05-11","events":14,"ips":13},{"day":"2026-05-12","events":11,"ips":9},{"day":"2026-05-13","events":8,"ips":6},{"day":"2026-05-14","events":10,"ips":10},{"day":"2026-05-15","events":12,"ips":11},{"day":"2026-05-16","events":8,"ips":7},{"day":"2026-05-17","events":9,"ips":9},{"day":"2026-05-18","events":8,"ips":8},{"day":"2026-05-19","events":6,"ips":6},{"day":"2026-05-20","events":9,"ips":9},{"day":"2026-05-21","events":9,"ips":9},{"day":"2026-05-22","events":6,"ips":6},{"day":"2026-05-23","events":6,"ips":5},{"day":"2026-05-24","events":9,"ips":9},{"day":"2026-05-25","events":9,"ips":8},{"day":"2026-05-26","events":6,"ips":6},{"day":"2026-05-27","events":9,"ips":9},{"day":"2026-05-28","events":8,"ips":8},{"day":"2026-05-29","events":8,"ips":8},{"day":"2026-05-30","events":11,"ips":10},{"day":"2026-05-31","events":12,"ips":12},{"day":"2026-06-01","events":8,"ips":7},{"day":"2026-06-02","events":12,"ips":12},{"day":"2026-06-03","events":12,"ips":11},{"day":"2026-06-04","events":8,"ips":8},{"day":"2026-06-05","events":11,"ips":11},{"day":"2026-06-06","events":10,"ips":10},{"day":"2026-06-07","events":8,"ips":6},{"day":"2026-06-08","events":9,"ips":9},{"day":"2026-06-09","events":6,"ips":5},{"day":"2026-06-10","events":11,"ips":10},{"day":"2026-06-11","events":9,"ips":9},{"day":"2026-06-12","events":13,"ips":12},{"day":"2026-06-13","events":12,"ips":11},{"day":"2026-06-14","events":7,"ips":6},{"day":"2026-06-15","events":12,"ips":12},{"day":"2026-06-16","events":11,"ips":11},{"day":"2026-06-17","events":8,"ips":8},{"day":"2026-06-18","events":11,"ips":11},{"day":"2026-06-19","events":12,"ips":12},{"day":"2026-06-20","events":8,"ips":8},{"day":"2026-06-21","events":11,"ips":11},{"day":"2026-06-22","events":12,"ips":11},{"day":"2026-06-23","events":7,"ips":7},{"day":"2026-06-24","events":7,"ips":7},{"day":"2026-06-25","events":12,"ips":9},{"day":"2026-06-26","events":14,"ips":12},{"day":"2026-06-27","events":8,"ips":8},{"day":"2026-06-28","events":12,"ips":12},{"day":"2026-06-29","events":12,"ips":12},{"day":"2026-06-30","events":8,"ips":8},{"day":"2026-07-01","events":11,"ips":11},{"day":"2026-07-02","events":12,"ips":11},{"day":"2026-07-03","events":8,"ips":6},{"day":"2026-07-04","events":12,"ips":11},{"day":"2026-07-05","events":8,"ips":8},{"day":"2026-07-06","events":11,"ips":10},{"day":"2026-07-07","events":12,"ips":12},{"day":"2026-07-08","events":7,"ips":5},{"day":"2026-07-09","events":12,"ips":12},{"day":"2026-07-10","events":8,"ips":8},{"day":"2026-07-11","events":12,"ips":11},{"day":"2026-07-12","events":12,"ips":12},{"day":"2026-07-13","events":8,"ips":8},{"day":"2026-07-14","events":12,"ips":10},{"day":"2026-07-15","events":12,"ips":10},{"day":"2026-07-16","events":8,"ips":8},{"day":"2026-07-17","events":11,"ips":10},{"day":"2026-07-18","events":8,"ips":7},{"day":"2026-07-19","events":12,"ips":12},{"day":"2026-07-20","events":12,"ips":11},{"day":"2026-07-21","events":8,"ips":8},{"day":"2026-07-22","events":12,"ips":12},{"day":"2026-07-23","events":8,"ips":8},{"day":"2026-07-24","events":12,"ips":11},{"day":"2026-07-25","events":12,"ips":11},{"day":"2026-07-26","events":8,"ips":8},{"day":"2026-07-27","events":11,"ips":10},{"day":"2026-07-28","events":3,"ips":3}],"window_hours":2160}