LANSCOPE CVE-2025-61932: Agent RCE Exploited in Japan

What to do

List every endpoint running the LANSCOPE client program (MR) or detection agent (DA) and confirm each is on a fixed build for its branch; the manager server alone is not enough.
Update the On-Premises Sub-Manager Server past 9.4.7.3 for the February 2026 path traversal CVE-2026-25785.
Find agents on internet-reachable hosts, such as LANSCOPE servers, public Windows servers or SIM-equipped laptops with global IPs, and remove direct exposure.
Search logs for the JPCERT/CC and Sophos indicators below, going back to April 2025.
If you find a hit, treat it as an Active Directory compromise: isolate hosts, reset privileged credentials and review data that left through file-sharing services.

How to check if you are affected or compromised

Search firewall, proxy and EDR logs since April 2025 for 38.54.56[.]57 and 38.54.88[.]172 on TCP 443, and for inbound connections from 38.54.56[.]10, 38.60.212[.]85 and 108.61.161[.]118.
Look for listeners on TCP 38000 or 38002, which Sophos saw opened by the Gokcpdoor backdoor.
Hunt for oci.dll (Gokcpdoor), MaxxAudioMeters64LOC.dll (Havoc) and winupdate.exe (the goddi AD dumper) in unusual locations, plus browser access to file.io, LimeWire or Piping Server from servers.

What happened#

On October 20, 2025, Motex warned customers about CVE-2025-61932 in LANSCOPE Endpoint Manager On-Premises, a Japanese asset and endpoint management suite. The bug is in the client program (MR) and detection agent (DA) installed on managed PCs and servers. Per JVN#86318557, the agents do not properly verify where incoming requests come from (CWE-940), so a crafted packet can run arbitrary code. JPCERT/CC, as CNA, scores it CVSS 3.0 9.8 and CVSS 4.0 9.3. Motex said customer environments had already received malicious packets from outside.

JPCERT/CC added that it knew of attack activity against Japanese organizations that suggests this bug was exploited, dating back to April 2025. It published five attacker IP addresses. CISA added the CVE to the KEV catalog on October 22, 2025, with a November 12 deadline. CISA's notes rate it automatable, with total technical impact.

Sophos' Counter Threat Unit then attributed a mid-2025 campaign to BRONZE BUTLER, also called Tick, a Chinese state-sponsored group active since 2010. The same group used a zero-day in another Japanese asset management product, SKYSEA Client View, in 2016. Sophos says the bug gave SYSTEM-level command execution. The attackers deployed a new Gokcpdoor backdoor variant or the Havoc C2 framework, loaded through OAED Loader. They dumped Active Directory with goddi, moved over remote desktop through the backdoor tunnel, packed data with 7-Zip and visited file.io, LimeWire and Piping Server in a browser.

Who is affected#

MR and DA Ver.9.4.7.1 and earlier, per the CVE record. Fixed builds exist for each branch, from 9.3.2.7 to 9.4.7.3. Motex says every client PC needs the update, not the manager server. The cloud edition is not affected. JPCERT/CC flags the highest-risk setups: agents on LANSCOPE servers placed on the internet, internet-facing Windows servers, and SIM-equipped PCs with global IP addresses.

Do you really need to act?#

If you run the On-Premises edition, yes, but as a check. Sophos judged the number of vulnerable internet-facing devices to be low. It warned that attackers already inside a network could use the agents for privilege escalation and lateral movement. An agent sits on nearly every managed endpoint, so one missed update group leaves a path. Neither Motex nor JPCERT/CC named the targeted port publicly.

A fixed agent is not the end of it. In February 2026, JVN#79096585 disclosed CVE-2026-25785, a path traversal in the On-Premises Sub-Manager Server 9.4.7.3 and earlier, also scored 9.8. No exploitation of it had been reported as of Oct 23, 2026.

What to do now#

From the LANSCOPE console, list every MR and DA install and confirm each is on a fixed build for its branch.
Update the Sub-Manager Server past 9.4.7.3.
Remove direct internet exposure from any host running an agent.
Run the hunts below, going back to April 2025.

How to tell if you were hit#

Search firewall and proxy logs for 38.54.56[.]57 and 38.54.88[.]172 on TCP 443, and for 38.54.56[.]10, 38.60.212[.]85 and 108.61.161[.]118.
On Windows hosts, run Get-NetTCPConnection -State Listen | Where-Object LocalPort -in 38000,38002. Sophos saw Gokcpdoor listen on those ports.
Hunt for oci.dll, MaxxAudioMeters64LOC.dll and winupdate.exe outside their normal locations. Sophos lists hashes for each.

Timeline#

Apr 2025 — Start of attack activity, per JPCERT/CC.
Oct 20, 2025 — Motex, JVN and JPCERT/CC disclose the bug and fixed builds.
Oct 22, 2025 — CISA adds CVE-2025-61932 to KEV.
Nov 1, 2025 — BleepingComputer reports Sophos' BRONZE BUTLER attribution.
Feb 25, 2026 — JVN discloses CVE-2026-25785 in the Sub-Manager Server.

Vulnerability records

CVE-2025-61932 · KEV 2025-10-22 · Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests, allowing an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

Coverage and analysis

BleepingComputer — China-linked hackers exploited Lanscope flaw as a zero-day in attacks bleepingcomputer.com