WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures
WSUS NTLM Relay Attack Chain Enables Malicious Update (TL-2026-1966), also tracked as Turning Enterprise Update Servers Into Backdoor Factories, is a high-severity supply-chain compromise, first published 2026-08-10. It has no confirmed attribution, affects Microsoft Windows Server Update Services (WSUS) with SUSDB on a, maps to 8 MITRE ATT&CK techniques (T1036, T1078.002, T1187), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-1966
- Threat ID
- TL-2026-1966
- Also known as
- Turning Enterprise Update Servers Into Backdoor Factories, NotWSUSpicious WSUS Attack Chain
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise-it
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in WSUS NTLM Relay Attack Chain Enables Malicious Update
Malware and tooling: BitsWebServer.py, MSSQLHound, NotWSUSpicious, Ntlmrelayx, PetitPotam, SharpWSUS, custom mssqlclient.py (Impacket fork), ludus_wsus
SpecterOps demonstrated an attack chain against split-host WSUS deployments: an attacker coerces the WSUS server's machine account to authenticate to a relay point, relays that NTLM authentication to the SQL Server hosting SUSDB, then chains native stored procedures (spImportUpdate through spDeployUpdate) to forge and covertly push a malicious Windows update to a chosen target group. Public tooling (NotWSUSpicious, ludus_wsus) implements the chain; no CVE has been assigned and no in-the-wild exploitation has been confirmed.
How WSUS NTLM Relay Attack Chain Enables Malicious Update works
On 2026-08-05, SpecterOps researcher Beyviel David ("Bagel") published a two-part technical disclosure (tied to a Black Hat USA 2026 talk, "Turning Enterprise Update Servers Into Backdoor Factories") describing how a common WSUS architecture choice — hosting the SUSDB database on a SQL Server instance separate from the WSUS application server — creates a network-relay attack surface into the update-distribution pipeline itself.
The attack begins with authentication coercion: the researcher used PetitPotam to force the upstream WSUS server's machine account (e.g. WSUS1$) to initiate SMB authentication toward an attacker-controlled listener. Impacket's Ntlmrelayx then relays that captured NTLM authentication over the TDS protocol to the remote SQL Server hosting SUSDB, establishing a live SQL session as the WSUS computer account. That account is a member of the SUSDB `webService` database role, which — while lacking direct SELECT/UPDATE/DELETE rights — retains EXECUTE permission on a set of native stored procedures that were never designed to be reachable by an untrusted network relay.
From that session, the attacker chains `spImportUpdate` (creates the update record and returns a RevisionID), `spSaveXmlFragment` (writes UpdateIdentity, LocalizedProperties, and ExtendedProperties XML fragments — including FileName, FileDigest, InstallCommand, and RebootBehavior), `spSetBatchURL` (points the update's payload at an attacker-hosted file), `spCreateTargetGroup` and `spAddComputerToTargetGroup` (scope the malicious update to one or a handful of victim computers instead of the whole fleet), and finally `spDeployUpdate` (marks the update approved and assigned with an installation deadline). By embedding the built-in "Critical" update-category GUID (`E6CF1350-C01B-414D-A61F-263D14D133B4`) in the forged prerequisites, the update also qualifies for WSUS's Default Automatic Approval Rule, so it installs without any administrator clicking approve.
SpecterOps released NotWSUSpicious (Python 3.11+), which automates SQL generation for this chain — computing SHA-1/SHA-256/file-size metadata, emitting the stored-procedure calls, and driving them through a custom Impacket-based `mssqlclient.py` over a Ntlmrelayx-established SOCKS proxy (proxychains, port 1080). A companion tool, BitsWebServer.py, serves the payload to the victim over the BITS protocol (default port 8080) with HTTP range-request support to mimic legitimate Windows Update delivery. Independent reporting (cybersecuritynews.com, 2026-08-06) added that reverse-engineering of `Microsoft.UpdateServices.ContentSyncAgent.dll` uncovered a logic error in its digital-signature verification routine: files whose names end in `.txt` or `.esd` skip signature validation entirely, letting an unsigned, attacker-supplied executable (delivered as e.g. `payload.exe.txt`) execute on the endpoint via the normal BITS/Windows Update install path. The same reporting noted the forged update can be configured to automatically redeploy if the payload process is terminated, giving the technique a self-healing quality on the target.
SpecterOps also released ludus_wsus, an Ansible role for the Ludus lab framework that stands up a reproducer environment (a domain controller, a Windows Server 2019 WSUS host, a separate SQL Server 2022 SUSDB host, and Windows 11/Server 2016 clients under WSUS-managed GPO) so defenders can rebuild and instrument the exact vulnerable topology.
No CVE has been assigned to this stored-procedure/NTLM-relay chain as of publication, and none of the primary sources report confirmed in-the-wild exploitation — this is public offensive-security research with released PoC tooling, not an observed campaign. Separately, and not to be conflated with this technique, Microsoft's July 2026 Patch Tuesday shipped CVE-2026-50444, a distinct WSUS elevation-of-privilege vulnerability (CWE-306, missing authentication for a critical function, CVSS 8.8) affecting Windows Server 2012 through 2025; none of the SpecterOps or follow-on reporting on this specific chain references that CVE as the underlying fix, so it is documented here only as contemporaneous WSUS-hardening context, not as the CVE for this attack chain.
Core mitigations converge on removing the relay path and the excess trust: enforce SMB signing and Extended Protection for Authentication (EPA) on the SQL Server hosting SUSDB, restrict network reachability to that SQL instance to the WSUS server only, and prefer co-locating WSUS with its database (or using the Windows Internal Database) so no NTLM-relayable network hop exists between them.
MITRE ATT&CK techniques used in TL-2026-1966
Defense Evasion
T1036 Masquerading; T1197 BITS Jobs
Privilege Escalation
Credential Access
T1187 Forced Authentication; T1557.001 Name Resolution Poisoning and SMB Relay
Initial Access
T1195.003 Compromise Hardware Supply Chain
defense-impairment
Resource Development
Affected products and versions in WSUS NTLM Relay Attack Chain Enables Malicious Update
- Microsoft — Windows Server Update Services (WSUS) with SUSDB on a separate SQL Server host
Vulnerable versions: Any WSUS deployment where SUSDB is hosted on a SQL Server instance separate from the WSUS application server (WSUS on Windows Server 2016 and newer per the released lab; not applicable to single-host/WID deployments)
Fixed in: No vendor patch published as of 2026-08-07; requires configuration mitigation (EPA, SMB signing, network restriction) rather than a code fix - Microsoft — Windows Update Agent / BITS content delivery (Microsoft.UpdateServices.ContentSyncAgent.dll signature verification)
Vulnerable versions: Signature-verification logic that skips digital-signature validation for payload filenames ending in .txt or .esd, per reverse-engineering reported 2026-08-06
Fixed in: No vendor patch published as of the source reporting
Remediation for WSUS NTLM Relay Attack Chain Enables Malicious Update
Immediate actions
- Enable Extended Protection for Authentication (EPA) on the SQL Server instance hosting SUSDB to block relayed NTLM authentication
- Enforce SMB signing on the WSUS server, the SUSDB SQL Server, and any hosts reachable by the WSUS computer account
- Restrict network access to the SUSDB SQL Server so only the WSUS application server (and authorized DBAs) can connect to it
- Audit SUSDB for anomalous stored-procedure activity from the WSUS computer account, especially spImportUpdate, spCreateTargetGroup, spAddComputerToTargetGroup, and spDeployUpdate calls outside normal sync windows
- Review and tighten the SUSDB webService database role's EXECUTE grants where the deployment does not require the full stored-procedure surface
Workarounds
- Periodically audit WSUS target groups for unexpected or newly created groups and their computer membership
- Monitor the registry values WUServer/WUStatusServer under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate on clients for unauthorized changes to the configured update source
- Alert on files delivered via BITS/WSUS whose names end in .txt or .esd but are executed as code, given the documented ContentSyncAgent.dll signature-check bypass for those extensions
Longer-term hardening
- Co-locate the WSUS application role and its database (or use the Windows Internal Database) so no network-relayable authentication hop exists between them
- Disable or replace the Default Automatic Approval Rule for Critical/Security categories with mandatory manual review
- Migrate update management to a cloud-managed service (e.g. Windows Autopatch) where on-premises WSUS/SUSDB is not operationally required
- Transition WSUS/SQL authentication from NTLM to Kerberos-only where supported, and disable NTLM at the domain level where feasible
Weaknesses (CWE) in WSUS NTLM Relay Attack Chain Enables Malicious Update
CWE-294, CWE-269, CWE-306
Timeline of WSUS NTLM Relay Attack Chain Enables Malicious Update
- TrustedSec publishes "WSUS Is SUS: NTLM Relay Attacks in Plain Sight," documenting WSUS HTTP/HTTPS traffic interception and machine-account NTLM relay to LDAP/SMB as a prior exposure class.
- Microsoft ships CVE-2026-50444 (WSUS elevation-of-privilege, missing authentication for a critical function, CVSS 8.8) in July 2026 Patch Tuesday — a distinct WSUS flaw, not the SUSDB stored-procedure chain covered here.
- SpecterOps publishes "Weaponizing Windows Updates with NotWSUSpicious" and researcher Beyviel David ("Bagel") releases the NotWSUSpicious automation tool on GitHub.
- SpecterOps releases ludus_wsus, an Ansible role reproducing a vulnerable split-host WSUS/SUSDB lab topology for the Ludus framework.
- SpecterOps publishes Part 1 of "Turning Enterprise Update Servers Into Backdoor Factories," detailing NTLM-relay coercion of the WSUS machine account into SUSDB and chaining of spImportUpdate through spDeployUpdate to forge a deployable update.
- cybersecuritynews.com reports reverse-engineering findings that Microsoft.UpdateServices.ContentSyncAgent.dll skips digital-signature validation for payload files named with .txt or .esd extensions, and that forged updates can auto-redeploy if killed.
- GBHackers publishes summary coverage of the SpecterOps research, amplifying the attack chain to a wider security-news audience.
Sources cited for WSUS NTLM Relay Attack Chain Enables Malicious Update
- Hackers Can Abuse Microsoft WSUS Servers to Deploy Malicious Updates via NTLM Relay
- Turning Enterprise Update Servers Into Backdoor Factories (0_o) - Part 1
- Weaponizing Windows Updates with NotWSUSpicious
- Of Course We Built a WSUS Ludus Lab
- Hackers Can Leverage WSUS Servers to Deliver Malware and Compromise Enterprise Endpoints
- NotWSUSpicious (GitHub repository)
- ludus_wsus (GitHub repository)
- WSUS Is SUS: NTLM Relay Attacks in Plain Sight
- CVE-2026-50444 - Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
More in supply chain
- GHAPPIER Loader: npm Trusted-Publishing Abuse Compromises @dforge-core/dforge-mcp
- Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)
- indexed-btree npm Campaign: Runtime-Triggered Loader Evades Install-Script Defenses via BTree.prototype.set()
- GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaign
- Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin
Detection coverage for TL-2026-1966
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1966 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.