---
title: "ASUS Live Update CVE-2025-59374: ShadowHammer Backdoor"
url: https://erroneo.us/security/briefs/asus-live-update-shadowhammer-cve-2025-59374/
description: "A 2025 CVE for the 2018 ShadowHammer backdoor in ASUS Live Update, put in KEV in Dec 2025. Fixed in 3.6.8 in 2019; the tool is end-of-support. Uninstall it."
type: security-brief
section: "Security Digest"
date_published: 2019-03-25
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2025-59374"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ASUS Live Update CVE-2025-59374: ShadowHammer Backdoor

**Verdict: Most can relax.** This is a 2025 CVE label for a 2018 supply-chain attack aimed at about 600 machines and fixed in 2019; uninstall ASUS Live Update if it is still around, but there is no public report of new exploitation.

- **Who must act:** Anyone who still has ASUS Live Update on old ASUS laptops (remove it), and organizations whose ASUS laptops ran it between June and November 2018 and never checked for ShadowHammer targeting.
- **Who can relax:** Owners of newer ASUS devices that ship MyASUS instead of Live Update, anyone already on Live Update 3.6.8 or later, and everyone who never ran the tool in 2018.
- **Affected:** ASUS Live Update builds distributed June to November 2018 (trojanized and signed with ASUS certificates); ASUS Live Update before 3.6.6 per the CVE record; ASUS advises 3.6.8 or later
- **Fixed:** ASUS Live Update 3.6.8 (2019) and later; last release 3.6.15; Product is end-of-support: remove it
- **CVEs:** CVE-2025-59374
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find ASUS Live Update on Windows endpoints and record the version.
2. Uninstall it; ASUS says Live Update is end-of-support and newer models use MyASUS instead.
3. If it must stay for now, confirm it is version 3.6.8 or later.
4. Only if you kept logs from 2018-2019, search them for Kaspersky's ShadowHammer indicators.

### How to check if you are affected

- Check installed software for ASUS Live Update and its version; anything below 3.6.8 predates the fix.
- Search retained DNS and proxy logs for asushotfix[.]com and traffic to 141.105.71[.]116 (Kaspersky IOCs).
- Search AV history for HEUR:Trojan.Win32.ShadowHammer.gen or other vendors' ShadowHammer/ShadowPad detections.

## What happened

On March 25, 2019, Kaspersky disclosed [Operation ShadowHammer](https://securelist.com/operation-shadowhammer/89992/). Between June and November 2018, attackers trojanized ASUS Live Update, the utility ASUS used to deliver BIOS, UEFI and driver updates to its computers. The malicious updaters "were signed with legitimate certificates" from ASUS. Kaspersky counted "over 57,000 Kaspersky users" who installed a backdoored version and estimated the real total could exceed a million.

The payload was narrow. It activated only on machines whose network adapter MAC addresses matched a hardcoded list, and Kaspersky extracted "more than 600 unique MAC addresses from over 200 samples." Kaspersky linked the operation to the 2017 ShadowPad incident and the BARIUM group. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-flaw-in-asus-update-tool/) attributes it to APT41 (Brass Typhoon). ASUS fixed the client in Live Update 3.6.8, and its [FAQ](https://www.asus.com/support/faq/1018727/) still tells users to "update the ASUS Live Update to V3.6.8 or higher".

Six years later, on December 17, 2025, ASUS as CNA published [CVE-2025-59374](https://www.cve.org/CVERecord?id=CVE-2025-59374) for the incident. The record is tagged "UNSUPPORTED WHEN ASSIGNED", lists versions before 3.6.6 as affected, and is scored CVSS 4.0 9.3. CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374) the same day, set a January 7, 2026 deadline, and told agencies to discontinue the product.

## Who is affected

Only ASUS computers that installed a trojanized Live Update build in 2018 were exposed, and only the targeted MAC addresses received the second stage. The CVE record says the client reached end of support in October 2021 and that "no currently supported devices or products are affected". The ASUS FAQ instead dates the end-of-support announcement to December 4, 2025, with 3.6.15 as the last version. Either way, the product is retired. ASUS says newer laptops use MyASUS in its place.

## Do you really need to act?

Barely. KEV needs three things: a CVE ID, reliable evidence of exploitation, and a clear fix ([CISA's criteria](https://www.cisa.gov/known-exploited-vulnerabilities)). ShadowHammer always met the second and third. What was missing until December 2025 was the CVE ID. Asked by [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-flags-asus-live-update-cve-but-the-attack-is-years-old/), CISA pointed to BOD 22-01: KEV addition "does not indicate that CISA is observing current active exploitation." As of Oct 23, 2026, there is no public report of new ShadowHammer activity. The listing documents a 2018 attack.

The useful action is housekeeping. Unsupported vendor updaters that run with high privileges and fetch code from the internet are worth removing anyway.

## What to do now

1. Find installs: `Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Live Update*' | Select-Object DisplayName, DisplayVersion`. You can also query your software inventory.
2. Uninstall ASUS Live Update through Programs and Features or your endpoint tool. Use MyASUS or ASUS support downloads for drivers and BIOS.
3. If removal has to wait, confirm the version is 3.6.8 or later (tray icon > About, or Programs and Features).
4. If you kept DNS, proxy or AV logs from 2018 and 2019, run the indicators below against them once, then close the item.

## How to tell if you were hit

For a 2018 compromise, the evidence lives in old logs. Kaspersky's public indicators include the domain `asushotfix[.]com`, the IP address `141.105.71[.]116`, and the detection name `HEUR:Trojan.Win32.ShadowHammer.gen`. Kaspersky also released a checker that compared a machine's MAC addresses with the target list. A hit on a targeted MAC address means the machine was an intended victim of a state-backed operation. Rebuild or retire that machine and review what it had access to at the time. If you have no logs from that period, removing the software is the practical end state.

## Timeline

- Mar 25, 2019 — Kaspersky discloses Operation ShadowHammer, a campaign that ran from June to November 2018. ASUS ships the fixed Live Update 3.6.8 the same month.
- Dec 4, 2025 — ASUS announces end of support for Live Update (last version 3.6.15).
- Dec 17, 2025 — ASUS publishes CVE-2025-59374, and CISA adds it to KEV.
- Jan 7, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [ASUS — How do I ensure that my device has the latest and safest version of ASUS Live Update?](https://www.asus.com/support/faq/1018727/)
2. [CVE record — CVE-2025-59374](https://www.cve.org/CVERecord?id=CVE-2025-59374)
3. [NVD — CVE-2025-59374](https://nvd.nist.gov/vuln/detail/CVE-2025-59374)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-59374](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374)
5. [CISA — Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities)
6. [Kaspersky Securelist — Operation ShadowHammer](https://securelist.com/operation-shadowhammer/89992/)
7. [BleepingComputer — CISA flags ASUS Live Update CVE, but the attack is years old](https://www.bleepingcomputer.com/news/security/cisa-flags-asus-live-update-cve-but-the-attack-is-years-old/)
8. [SecurityWeek — CISA Warns of Exploited Flaw in Asus Update Tool](https://www.securityweek.com/cisa-warns-of-exploited-flaw-in-asus-update-tool/)

---
Source page: https://erroneo.us/security/briefs/asus-live-update-shadowhammer-cve-2025-59374/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt