Threat Actors Exploit LANSCOPE Endpoint Manager Zero-Day Vulnerability to Steal Confidential Data

According to Secureworks Counter Threat Unit (CTU) researchers, BRONZE BUTLER, described as a Chinese state‑sponsored threat actor, exploited a critical zero‑day in Motex LANSCOPE Endpoint Manager to gain unauthorized access to corporate networks and exfiltrate sensitive data. The campaign centres on CVE‑2025‑61932, which enables remote code execution with SYSTEM privileges, allowing attackers to install backdoors and move laterally across affected environments.

JPCERT/CC officially disclosed the vulnerability on 22 October 2025, with CISA adding the exploit to its Known Exploited Vulnerabilities Catalog the same day, underscoring the rapid international response. In the operation, attackers deployed OAED Loader alongside backdoors and compressed stolen data using 7‑Zip before exfiltrating via cloud storage services such as Piping Server and LimeWire during remote sessions.

CTU notes that the number of internet‑facing LANSCOPE devices is relatively limited, but the potential impact remains high, enabling privilege escalation and broad lateral movement within already compromised networks. Organisations running LANSCOPE endpoints should patch vulnerable systems promptly and review internet‑facing servers to justify public exposure.