China-linked group exploits zero-day vulnerability in Lanscope to take control of corporate systems

The exploitation of a recently disclosed critical vulnerability in Motex Lanscope Endpoint Manager is attributed to a cyberespionage group known as Tick.

The vulnerability, tracked as CVE-2025-61932 (CVSS score: 9.3), allows remote attackers to execute arbitrary commands with SYSTEM privileges on local versions of the program. In an advisory issued this month, JPCERT/CC said it had confirmed reports of active exploitation of the vulnerability to install a backdoor on compromised systems.

Tick, also known as Bronze Butler, Daserf, REDBALDKNIGHT, Stalker Panda, Stalker Taurus, and Swirl Typhoon (formerly Tellurium), is a Chinese cyberespionage group known for its large-scale targeting of East Asia, particularly Japan. It is believed to have been active since at least 2006.

„We are aware of a lot of targeted activity in Japan and believe that Bronze Butler’s exploitation was limited to sectors consistent with their intelligence objectives,“ Rafe Pilling, Director of Threat Intelligence at Sophos CTU, told The Hacker News. „Since this vulnerability has now been publicly disclosed, it is possible that other malicious actors may also attempt to exploit it.“

The sophisticated campaign observed by Sophos involved the exploitation of CVE-2025-61932 to deliver a known backdoor called Gokcpdoor, which can establish a proxy connection to a remote server and act as a backdoor to execute malicious commands on the compromised host.

„"The 2025 variant has dropped support for the KCP protocol and added multiplexed communication via an external library [smux] for its communication with the command and control (C2) server," the Sophos Counter Threat Unit (CTU) said in a report on Thursday.

The cybersecurity company states that it has identified two different types of Gokcpdoor, serving different purposes:

• A server type that listens for incoming client connections to provide remote access

• A client type that initiates connections to predefined C2 servers in order to establish a covert communication channel

The attack is also characterized by the implementation of Havoc, a post-exploitation framework, and the infection chain relies on DLL side-loading to launch a DLL loader called OAED Loader, which injects the payload.

Some of the other tools used in the attack to facilitate horizontal movement and data extraction include:

goddi – an open source tool for extracting information from Active Directory, Remote Desktop – for remote access via a backdoor tunnel, and 7-Zip

It was also found that attackers accessed cloud services such as io, LimeWire, and Piping Server via a web browser during remote sessions, with the aim of extracting the collected data.

This is not the first time that the Tick group has been observed using zero-day vulnerabilities in its campaigns. In October 2017, Secureworks (owned by Sophos) documented the exploitation of a still-unpatched remote code execution vulnerability (CVE-2016-7836) in SKYSEA Client View – a Japanese IT asset management software – to compromise systems and steal data.

„"Organizations should update vulnerable Lanscope servers as appropriate for their environments," the Sophos Threat Response Unit (TRU) said in a statement. "It is also recommended to review publicly accessible Lanscope servers that have the Lanscope client (MR) or detection agent (DA) installed to determine if there is a real business need for them to be publicly accessible."“

Source: https://thehackernews.com/