CVE-2025-59374: ASUS Live Update contains malicious code, actively exploited. Defensive takeaway: Disable or uninstall ASUS Live Update imme

CVE-2025-59374 is not a conventional remote exploitation bug but the re-labeling of Operation ShadowHammer, a supply chain compromise that inserted malicious code into ASUS Live Update between June and November 2018. The threat actor, linked by Kaspersky research to ShadowPad and publicly identified in court documents as the BARIUM APT group (also tracked as APT41, Brass Typhoon, Wicked Panda), signed trojanized builds with legitimate ASUS certificates and hosted them on official update servers at liveupdate01.asus.com and liveupdate01s.asus.com. The CVSS 9.3 score reflects embedded malicious code rather than a network-accessible service vulnerability, and CISA added it to the KEV Catalog on December 17, 2025 with evidence of active exploitation.

The exposure profile is narrower than the headline suggests and that is the critical analytical point. Over one million ASUS users may have downloaded the backdoored utility, and Kaspersky telemetry recorded more than 57,000 confirmed installations, yet the malware carried a hard-coded list of over 600 unique MAC addresses and only activated on matching devices. Most victims received a dormant payload; the surgical targeting means organizational risk depends heavily on whether any endpoint MAC address appears in the attacker-defined list rather than on simple presence of the software. This distinction matters because a blanket patch campaign treats the issue like a mass remote code execution flaw, when the actual threat is a targeted supply chain implant designed to evade broad detection.

Defenders should treat any ASUS Live Update version below 3.6.8 as compromised, since that is the fix version ASUS released in March 2019. The utility reached end of support on December 4, 2025, with final version 3.6.15, and CISA urged federal agencies to discontinue use by January 7, 2026. Immediate actions are to uninstall the utility or disable its execution, block or monitor for connections to the malicious infrastructure domains such as asushotfix.com and the IP 141.105.71.116, and hunt for the ShadowHammer indicators including the file hashes aa15eb28292321b586c27d8401703494 (MD5) and bebb16193e4b80f4bc053e4fa818aa4e2832885392469cd5b8ace5cec7e4ca19 (SHA256) and the Kaspersky detection verdict HEUR:Trojan.Win32.ShadowHammer.gen. Review endpoint logs for installations of Live Update versions 3.6.15 or earlier, check for updates pulled from the official ASUS servers that occurred between June and November 2018, and compare adapter MAC addresses against the 600-plus address list if threat intelligence feeds provide it.

Watch for new malware samples that expand the hard-coded MAC address list or reuse the ShadowPad backdoor infrastructure, because any additional targets would shift the exposure from historical surgical strikes to broader active compromise. Another key development would be an updated CISA binding operational directive that extends the remediation deadline or releases additional IoCs, which would signal either expanded exploitation or newly confirmed targets.