Motex Lanscope exploitation, backdoor activity, and remediation

**CVE-2025-61932** is a critical **Motex Lanscope Endpoint Manager** vulnerability that was **actively exploited** as a **zero-day** by **Tick/BRONZE BUTLER** against **on-premises** systems. The flaw can let attackers run **arbitrary commands with SYSTEM privileges**, and **JPCERT/CC** confirmed reports of active abuse to drop a backdoor on compromised hosts. Sophos observed the campaign using **Gokcpdoor**, **Havoc**, and **DLL side-loading** with **OAED Loader** to maintain access, move laterally, and exfiltrate data. **CISA** added **CVE-2025-61932** to the **Known Exploited Vulnerabilities** catalog, and fixes are available for affected **Client program** and **Detection Agent** releases.

A **Tick (Bronze Butler)** campaign exploited **CVE-2025-61932** in **Motex Lanscope Endpoint Manager** to deploy **Gokcpdoor** and gain remote access to compromised hosts. The operation enabled **SYSTEM**-level command execution, covert proxying, and follow-on tooling for **lateral movement** and **data exfiltration**. **JPCERT/CC** confirmed active abuse, showing the campaign was already being used against **on-premise** deployments.

**Motex** released a fix for **CVE-2025-61932** in **Lanscope**, addressing a **critical** on-premises flaw that had already been exploited as a **zero-day**. The patch narrows the exposed scope because **cloud deployments** are unaffected. The update matters because Lanscope is widely used in **Japan**, including by major listed and financial institutions.