Loading story…
The Chinese state-sponsored threat group BRONZE BUTLER (also known as Tick) exploited a zero-day vulnerability, CVE-2025-61932, in the Motex LANSCOPE Endpoint Manager software to gain SYSTEM-level control over targeted systems. This vulnerability allows remote attackers to execute arbitrary commands with elevated privileges, enabling initial access, privilege escalation, and lateral movement within compromised networks. The campaign was observed in mid-2025, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding the vulnerability to its Known Exploited Vulnerabilities Catalog on October 22, 2025. JPCERT/CC also issued a public notice regarding the issue.
BRONZE BUTLER leveraged the Gokcpdoor malware in this operation, which in its 2025 variant introduced multiplexing communication for command and control (C2) and discontinued support for the KCP protocol. The malware was deployed in both server and client configurations, enabling remote access and control over compromised assets. While the number of vulnerable internet-facing devices was reported to be low, the exploitation of internal systems posed significant risks for data theft and further compromise within affected organizations, particularly those using Japanese asset management software.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
On October 30, 2025, Sophos publicly detailed the campaign, attributing the activity to Bronze Butler and describing updated Gokcpdoor variants, OAED Loader, Havoc C2 use, lateral movement, exfiltration methods, and related indicators of compromise. The report also recommended upgrading vulnerable LANSCOPE servers and reviewing exposure of internet-facing components.
On October 22, 2025, CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities catalog, and JPCERT/CC published a notice the same day. CISA directed U.S. federal agencies to remediate the flaw by November 12, 2025.
On October 20, 2025, Motex disclosed CVE-2025-61932 as an emergency-severity flaw in LANSCOPE Endpoint Manager 9.4.7.2 and earlier and released patches. The vendor said the issue affects on-premises deployments and that the cloud version is not impacted.
In mid-2025, Sophos CTU observed Bronze Butler exploiting CVE-2025-61932 as a zero-day to gain remote code execution with SYSTEM privileges and steal confidential information. The intrusion chain deployed updated Gokcpdoor malware, and in some cases Havoc C2, with OAED Loader and DLL sideloading used to run payloads inside legitimate executables.
JPCERT/CC indicated domestic victims may date back to April 2025, suggesting Bronze Butler (Tick) began exploiting the Motex LANSCOPE Endpoint Manager flaw CVE-2025-61932 by then. The attacks targeted on-premises, internet-exposed Lanscope servers in Japan for cyber-espionage and data theft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourcenews.sophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-linked espionage group tracked as **Cicada**/**APT10** exploited Microsoft’s **Zerologon** flaw, `CVE-2020-1472`, in a long-running campaign against major Japanese companies and some overseas subsidiaries, including entities in the United States. Researchers said the attackers used the bug to compromise domain controllers, steal domain credentials, and effectively seize control of **Active Directory** environments, enabling credential theft, network reconnaissance, data exfiltration, and persistent access across victim networks. The operation combined public exploit activity around Zerologon with a broader post-compromise toolkit that included **QuasarRAT**, the newly observed **Backdoor.Hartip**, DLL side-loading, and administrative utilities such as **WMIExec**, **Certutil**, and **PowerShell**. Separate honeypot telemetry also showed in-the-wild Zerologon exploitation against exposed internet systems, underscoring how quickly the vulnerability moved from disclosure to active abuse while APT10 leveraged distinctive tradecraft such as `CppHostCLR`-based .NET loader execution and **ConfuserEx** obfuscation.
Aug 15, 2026
Proofpoint reported that the **BlueMoon** exploit kit chains three vulnerabilities to compromise Windows systems through Google Chrome: `CVE-2026-85046`, a V8 arbitrary-code-execution/type-confusion flaw; `CVE-2026-87491`, a V8 sandbox escape; and `CVE-2026-85880`, a Windows ALPC local privilege-escalation vulnerability. First observed on August 28 in China-linked TA412 operations targeting U.S. NGOs, mining companies, and commodities-trading firms, the kit was adopted by multiple espionage groups within days, exploiting the gap between Chromium source-code fixes and stable-browser patch deployment. Chinese actors identified as UTA0560 and JungleBamboo (APT31) used the Chrome-to-Windows chain in targeted spear-phishing against NGOs. UTA0560 deployed the **GRIMWEDGE** JScript backdoor, while JungleBamboo used **SUPERSTOMP** to install the **LONGTALE** credential-stealing Chrome extension. Organizations should prioritize Chrome and Windows security updates, investigate targeted phishing activity involving Chrome exploitation, and hunt for the named payloads and unauthorized browser extensions, particularly in NGO, mining, and commodities-trading environments.
Sep 25, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026