Chinese APT BRONZE BUTLER Exploits LANSCOPE Zero-Day for SYSTEM Control

According to Sophos Counter Threat Unit (CTU) researchers, the Chinese state‑sponsored BRONZE BUTLER group (also known as Tick) has run a sophisticated campaign exploiting a zero‑day in Motex LANSCOPE Endpoint Manager, tracked as CVE‑2025‑61932, to breach corporate networks and steal confidential information. The vulnerability allows remote attackers to execute arbitrary commands with SYSTEM privileges, and it was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 22 October 2025.

CTU observed the initial breach in mid‑2025, with the group using Gokcpdoor as the main backdoor for command and control, a variant introduced in 2025 that dropped KCP in favour of multiplexed communication via a third‑party library. On some systems, BRONZE BUTLER switched to the Havoc C2 framework, deployed alongside OAED Loader that injects a payload into a legitimate executable.

The attackers also leveraged legitimate tools such as goddi, Remote Desktop, and 7‑Zip, and accessed cloud storage services like io, LimeWire, and Piping Server during Remote Desktop sessions to exfiltrate data.