APT 'Bronze Butler' Exploits Zero-Day to Root Japan Orgs

APT group Bronze Butler exploited a zero-day vulnerability in Lanscope, a popular endpoint management tool in Japan, to root Japanese organisations. The issue, designated CVE-2025-61932, was disclosed by Lanscope developer Motex on 20 October and was rated 9.8 out of 10 on CVSS, signalling emergency severity.

According to Sophos, Bronze Butler (also known as Tick, RedBaldKnight, Stalker Panda, Swirl Typhoon) leveraged this flaw while it was still undisclosed to gain unfettered access across Japanese organisations, deploying its Gokcpdoor backdoor to steal data.

In some cases the attackers used the Havoc C2 tool or a loader called OAED to inject Gokcpdoor or Havoc into legitimate executables, and they also relied on OSS and cloud services for lateral movement and exfiltration, including 7-Zip, remote desktop and file[.]io, with LimeWire noted in exfiltration scenarios.

Reports also indicate that CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities catalog on 22 October 2022, and JPCERT/CC suggested that domestic organisations may have been affected as early as April 2025.