Tick Motex Lanscope CVE-2025-61932 exploitation campaign
Campaign
Summary
Hide ▲
Show ▼
A Tick (Bronze Butler) campaign exploited CVE-2025-61932 in Motex Lanscope Endpoint Manager to deploy Gokcpdoor and gain remote access to compromised hosts. The operation enabled SYSTEM-level command execution, covert proxying, and follow-on tooling for lateral movement and data exfiltration. JPCERT/CC confirmed active abuse, showing the campaign was already being used against on-premise deployments.
Cases
Related Happenings
Flowise Custom MCP RCE (CVE-2026-40933)
Vulnerability
H score31
First: 01.06.2026 17:00
Last: 01.06.2026 17:00
Sources 1
About this happening:
A critical RCE flaw in Flowise tracked as CVE-2026-40933 lets an attacker take over self-hosted deployments when a logged-in user imports a malicious workflow fi...
Flowise Custom MCP RCE (CVE-2026-40933)
VulnerabilityAbout this happening: A critical RCE flaw in Flowise tracked as CVE-2026-40933 lets an attacker take over self-hosted deployments when a logged-in user imports a malicious workflow fi...
Snow malware suite deployment by UNC6692
Malware Activity
H score29
First: 25.04.2026 18:07
Last: 25.04.2026 18:07
Sources 1
About this happening:
UNC6692 has deployed the Snow malware suite through social engineering, creating a stealthy path to credential theft and domain compromise. The operation uses em...
Snow malware suite deployment by UNC6692
Malware ActivityAbout this happening: UNC6692 has deployed the Snow malware suite through social engineering, creating a stealthy path to credential theft and domain compromise. The operation uses em...
Marimo CVE-2026-39987 exploitation wave
Exploitation Wave
H score51
First: 12.04.2026 17:20
Last: 12.04.2026 17:20
Sources 1
About this happening:
Marimo exploitation activity surged within 12 hours of disclosure, with 125 IP addresses beginning reconnaissance against CVE-2026-39987 and the /terminal/ws e...
Marimo CVE-2026-39987 exploitation wave
Exploitation WaveAbout this happening: Marimo exploitation activity surged within 12 hours of disclosure, with 125 IP addresses beginning reconnaissance against CVE-2026-39987 and the /terminal/ws e...
UNC6485 Triofox CVE-2025-12480 exploitation campaign
Campaign
H score40
First: 10.11.2025 22:49
Last: 10.11.2025 22:49
Sources 1
About this happening:
The UNC6485 campaign is actively exploiting CVE-2025-12480 in Gladinet Triofox, turning a patched flaw into unauthorized access and post-exploitation footholds. The ac...
UNC6485 Triofox CVE-2025-12480 exploitation campaign
CampaignAbout this happening: The UNC6485 campaign is actively exploiting CVE-2025-12480 in Gladinet Triofox, turning a patched flaw into unauthorized access and post-exploitation footholds. The ac...
Motex Lanscope Endpoint Manager actively exploited source verification RCE (CVE-2025-61932)
Vulnerability
H score52
First: 23.10.2025 08:37
Last: 23.10.2025 08:37
Sources 1
How related:
The vulnerability, tracked as CVE-2025-61932 (CVSS score: 9.3), allows remote attackers to execute arbitrary commands with SYSTEM privileges on on-premise versions of the program.
About this happening:
CVE-2025-61932 is a critical Motex Lanscope Endpoint Manager vulnerability that was actively exploited as a zero-day by Tick/BRONZE BUTLER against on-premise...
Motex Lanscope Endpoint Manager actively exploited source verification RCE (CVE-2025-61932)
VulnerabilityHow related: The vulnerability, tracked as CVE-2025-61932 (CVSS score: 9.3), allows remote attackers to execute arbitrary commands with SYSTEM privileges on on-premise versions of the program.
About this happening: CVE-2025-61932 is a critical Motex Lanscope Endpoint Manager vulnerability that was actively exploited as a zero-day by Tick/BRONZE BUTLER against on-premise...
Timeline
-
31.10.2025 15:26 2 articles · 8mo ago
Tick exploits CVE-2025-61932 in Motex Lanscope Endpoint Manager
Initial DisclosureTick is exploiting CVE-2025-61932 in on-premise Motex Lanscope Endpoint Manager systems to execute arbitrary commands with SYSTEM privileges and drop the Gokcpdoor backdoor. JPCERT/CC confirms active abuse of the flaw, and Sophos ties the activity to a cyber espionage campaign associated with Tick, also known as Bronze Butler, Daserf, REDBALDKNIGHT, Stalker Panda, Stalker Taurus, and Swirl Typhoon.
Show sources
- China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems — thehackernews.com — 31.10.2025 15:26
- China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems — thehackernews.com — 31.10.2025 15:26