China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems

The Hacker News reports that the China-linked Tick group has exploited a Lanscope zero‑day to hijack corporate systems, using CVE-2025-61932, which Sophos CTU says allows remote code execution with SYSTEM privileges on on‑premise Lanscope EndPoint Manager installations.

The campaign, observed by Sophos, delivered a backdoor referred to as Gokcpdoor and established covert command and control channels via a proxy connection, with both a server type for accepting connections and a client type that connects to hard-coded C2 servers. The attackers also deployed the Havoc post‑exploitation framework and used DLL side‑loading to launch an OAED Loader DLL, facilitating payload injection.

Lateral movement and data exfiltration were aided by tools including goddi, Remote Desktop, and 7‑Zip, while the actors reportedly accessed cloud services during remote sessions to harvest data. Tick, also known as Bronze Butler and several other aliases, is described as a Chinese cyber espionage actor active since at least 2006 and with a focus on East Asia, particularly Japan, according to the report and prior alerts from JPCERT/CC.