China-linked “Tick Group” exploits new Lanscope zero-day

China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems

Published on: November 1, 2025
By: Kooch Cybersecurity & Compliance Team

A new zero-day under active exploitation

A recently disclosed critical vulnerability (CVE-2025-61932) in Motex Lanscope Endpoint Manager is being actively exploited by the China-linked advanced persistent threat (APT) group known as Tick.
The flaw, with a CVSS score of 9.3, allows remote code execution with SYSTEM-level privileges on on-premise Lanscope servers — giving attackers complete control over affected corporate endpoints.

The Japan Computer Emergency Response Team (JPCERT/CC) confirmed reports of active abuse in October 2025, warning that attackers have already deployed backdoors on compromised systems.

Who is the Tick Group?

Tick — also known as Bronze Butler, Daserf, REDBALDKNIGHT, Stalker Panda, and Swirl Typhoon — is a China-based cyber-espionage group active since at least 2006.
The group is known for its long-term focus on East Asian targets, particularly Japanese corporations and government networks, with operations believed to align closely with state-level intelligence objectives.

According to Sophos CTU Director Rafe Pilling, “the exploitation by Bronze Butler appears limited to sectors aligned with their intelligence objectives — but since the flaw is now public, other threat actors may follow.”

How the attack works

Sophos researchers observed Tick exploiting CVE-2025-61932 to deliver a new variant of the Gokcpdoor backdoor, capable of establishing covert proxy connections with remote servers and executing malicious commands.

This 2025 variant replaced its old KCP protocol with multiplexed communication via the ‘smux’ library, improving stealth and reliability.

Two distinct Gokcpdoor types were identified:

Server Type – Listens for incoming client connections, enabling remote control.
Client Type – Connects to hard-coded command-and-control (C2) servers to create covert channels.

Post-exploitation and persistence

After initial access, Tick deployed the Havoc post-exploitation framework, using DLL side-loading techniques to launch a custom loader called OAED Loader that injected malicious payloads into legitimate processes.

Further activity included:

goddi – open-source Active Directory dumping tool
Remote Desktop tunneling – for hands-on-keyboard control
7-Zip – to compress and exfiltrate stolen data
Cloud services (LimeWire, io, Piping Server) – to transfer harvested information covertly

A familiar pattern of zero-day exploitation

This is not Tick’s first known use of a zero-day in Japan.
In 2017, Sophos-owned Secureworks documented how the same group exploited CVE-2016-7836 in SKYSEA Client View, another Japanese IT asset management platform, to infiltrate corporate systems.

The repeated targeting of endpoint management software highlights a strategic pattern: attackers are compromising the very tools organizations rely on for control, visibility, and compliance.

Mitigation and defense recommendations

Sophos Threat Response Unit (TRU) strongly recommends that organizations:

Upgrade Lanscope Endpoint Manager immediately to a patched version.
Audit internet-facing Lanscope servers, clients (MR), and detection agents (DA) — and restrict external access unless absolutely necessary.
Monitor for suspicious activity, especially DLL side-loading, 7-Zip compression, and unauthorized Remote Desktop sessions.
Hunt for indicators of Gokcpdoor or Havoc in network and endpoint telemetry.
Implement EDR and behavioral analytics capable of detecting living-off-the-land post-exploitation tactics.

What this means for cybersecurity leaders

This incident supports a review of administrative-tool security:

A compromised management tool may give an attacker access to other systems.

Endpoint management platforms, RMMs, and IT asset management solutions have deep system-level privileges, making them high-value targets for espionage groups.
Organizations must treat these tools with the same security rigor as critical infrastructure — segmentation, monitoring, and patch prioritization are non-negotiable.

Kooch’s Perspective

At Kooch Cybersecurity & Compliance, we review administrative-tool risks in work involving KVKK, GDPR, or ISO 27001.
A compromise of administrative tools can expose personal data. Assess the data and systems involved alongside technical remediation.

Include patch reviews, supplier risk assessments and incident-response exercises in the security programme.

Monitoring priorities

Keep an asset inventory and monitor administrative activity so the team can investigate unexpected changes.

Source

This article was based on original reporting by Ravie Lakshmanan at The Hacker News:
“China-Linked Tick Group Exploits Lanscope Zero-Day to Hijack Corporate Systems,” published October 31, 2025.
TheHackerNews.com

Related guidance and practical next steps

Masoud Salmani