ASUS Live Update CVE-2025-59374: ShadowHammer Backdoor

What to do

1. Find ASUS Live Update on Windows endpoints and record the version.
2. Uninstall it; ASUS says Live Update is end-of-support and newer models use MyASUS instead.
3. If it must stay for now, confirm it is version 3.6.8 or later.
4. Only if you kept logs from 2018-2019, search them for Kaspersky's ShadowHammer indicators.

How to check if you are affected or compromised

• Check installed software for ASUS Live Update and its version; anything below 3.6.8 predates the fix.
• Search retained DNS and proxy logs for asushotfix[.]com and traffic to 141.105.71[.]116 (Kaspersky IOCs).
• Search AV history for HEUR:Trojan.Win32.ShadowHammer.gen or other vendors' ShadowHammer/ShadowPad detections.

What happened#

On March 25, 2019, Kaspersky disclosed Operation ShadowHammer. Between June and November 2018, attackers trojanized ASUS Live Update, the utility ASUS used to deliver BIOS, UEFI and driver updates to its computers. The malicious updaters "were signed with legitimate certificates" from ASUS. Kaspersky counted "over 57,000 Kaspersky users" who installed a backdoored version and estimated the real total could exceed a million.

The payload was narrow. It activated only on machines whose network adapter MAC addresses matched a hardcoded list, and Kaspersky extracted "more than 600 unique MAC addresses from over 200 samples." Kaspersky linked the operation to the 2017 ShadowPad incident and the BARIUM group. SecurityWeek attributes it to APT41 (Brass Typhoon). ASUS fixed the client in Live Update 3.6.8, and its FAQ still tells users to "update the ASUS Live Update to V3.6.8 or higher".

Six years later, on December 17, 2025, ASUS as CNA published CVE-2025-59374 for the incident. The record is tagged "UNSUPPORTED WHEN ASSIGNED", lists versions before 3.6.6 as affected, and is scored CVSS 4.0 9.3. CISA added it to KEV the same day, set a January 7, 2026 deadline, and told agencies to discontinue the product.

Who is affected#

Only ASUS computers that installed a trojanized Live Update build in 2018 were exposed, and only the targeted MAC addresses received the second stage. The CVE record says the client reached end of support in October 2021 and that "no currently supported devices or products are affected". The ASUS FAQ instead dates the end-of-support announcement to December 4, 2025, with 3.6.15 as the last version. Either way, the product is retired. ASUS says newer laptops use MyASUS in its place.

Do you really need to act?#

Barely. KEV needs three things: a CVE ID, reliable evidence of exploitation, and a clear fix (CISA's criteria). ShadowHammer always met the second and third. What was missing until December 2025 was the CVE ID. Asked by BleepingComputer, CISA pointed to BOD 22-01: KEV addition "does not indicate that CISA is observing current active exploitation." As of Oct 23, 2026, there is no public report of new ShadowHammer activity. The listing documents a 2018 attack.

The useful action is housekeeping. Unsupported vendor updaters that run with high privileges and fetch code from the internet are worth removing anyway.

What to do now#

1. Find installs: Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Live Update*' | Select-Object DisplayName, DisplayVersion. You can also query your software inventory.
2. Uninstall ASUS Live Update through Programs and Features or your endpoint tool. Use MyASUS or ASUS support downloads for drivers and BIOS.
3. If removal has to wait, confirm the version is 3.6.8 or later (tray icon > About, or Programs and Features).
4. If you kept DNS, proxy or AV logs from 2018 and 2019, run the indicators below against them once, then close the item.

How to tell if you were hit#

For a 2018 compromise, the evidence lives in old logs. Kaspersky's public indicators include the domain asushotfix[.]com, the IP address 141.105.71[.]116, and the detection name HEUR:Trojan.Win32.ShadowHammer.gen. Kaspersky also released a checker that compared a machine's MAC addresses with the target list. A hit on a targeted MAC address means the machine was an intended victim of a state-backed operation. Rebuild or retire that machine and review what it had access to at the time. If you have no logs from that period, removing the software is the practical end state.

Timeline#

• Mar 25, 2019 — Kaspersky discloses Operation ShadowHammer, a campaign that ran from June to November 2018. ASUS ships the fixed Live Update 3.6.8 the same month.
• Dec 4, 2025 — ASUS announces end of support for Live Update (last version 3.6.15).
• Dec 17, 2025 — ASUS publishes CVE-2025-59374, and CISA adds it to KEV.
• Jan 7, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2025-59374 · KEV 2025-12-17 · "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. ASUS — How do I ensure that my device has the latest and safest version of ASUS Live Update? asus.com
2. CVE record — CVE-2025-59374 cve.org
3. NVD — CVE-2025-59374 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-59374 cisa.gov
5. CISA — Reducing the Significant Risk of Known Exploited Vulnerabilities cisa.gov
6. Kaspersky Securelist — Operation ShadowHammer securelist.com

Coverage and analysis

1. BleepingComputer — CISA flags ASUS Live Update CVE, but the attack is years old bleepingcomputer.com
2. SecurityWeek — CISA Warns of Exploited Flaw in Asus Update Tool securityweek.com