CISA Adds Critical Motex LANSCOPE Endpoint Manager Vulnerability (CVE-2025-61932) to KEV Catalog Amid Active Exploitation
CISA Adds Actively Exploited Motex LANSCOPE RCE Flaw to KEV Catalog
Related Entities(initial)
Organizations
Products & Tech
CVE Identifiers
Full Report(when first published)
Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to patch a critical, actively exploited vulnerability in Motex's LANSCOPE Endpoint Manager. The vulnerability, tracked as CVE-2025-61932, has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog due to evidence of in-the-wild attacks. The flaw, with a CVSS v4 score of 9.3, allows an unauthenticated, remote attacker to execute arbitrary code on systems running the LANSCOPE agent. Reports from Japan's JPCERT/CC and Motex confirm that attackers are targeting the flaw to deploy backdoors, prompting CISA to set a remediation deadline of November 12, 2025, for federal agencies.
Vulnerability Details
The vulnerability exists in the on-premises versions of LANSCOPE Endpoint Manager, specifically affecting the Client Program (MR) and Detection Agent (DA) components. It is described as an 'improper verification of source of a communication channel.' This allows a remote attacker on the same network segment to send specially crafted network packets to a listening port on an endpoint with the LANSCOPE agent installed. Successful exploitation results in the execution of arbitrary code with the privileges of the agent, which are typically elevated.
Affected Systems
The vulnerability affects the following on-premises products:
- LANSCOPE Endpoint Manager Client Program (MR): Versions 9.4.7.1 and earlier
- LANSCOPE Endpoint Manager Detection Agent (DA): Versions 9.4.7.1 and earlier
Motex has released several patched versions to address the issue, and customers are urged to upgrade.
Exploitation Status
Active exploitation has been confirmed, primarily in Japan. Japan's JPCERT/CC and the JVN portal reported that malicious packets targeting the vulnerability were observed in domestic customer environments starting after April 2025. Motex also confirmed at least one customer received a malicious packet suspected of exploiting this flaw. The goal of the observed attacks is to install an unspecified backdoor on the compromised endpoint, providing the attacker with persistent remote access (T1505.003 - Web Shell). The addition to the CISA KEV catalog on October 22, 2025, underscores the seriousness and ongoing nature of the threat.
Impact Assessment
Compromising an endpoint management solution like LANSCOPE provides a powerful foothold within a network.
- Privilege Escalation & Lateral Movement: An attacker can use the initial compromise to escalate privileges on the endpoint and move laterally to other systems in the network.
- Widespread Compromise: If the management server itself can be compromised from an endpoint, the attacker could potentially push malicious software to all managed devices.
- Data Theft and Espionage: The installed backdoor can be used to exfiltrate sensitive data or conduct long-term espionage.
Cyber Observables for Detection
dtagent.exe, etc.)powershell.exe, cmd.exe) or anomalous network activity.Detection Methods
- Vulnerability Scanning: Use authenticated scans to identify endpoints running vulnerable versions of the LANSCOPE agent.
- Network Monitoring: Deploy network intrusion detection systems (NIDS) with signatures to detect the specific malicious packets used in the exploit.
- Endpoint Detection and Response (EDR): Use EDR to monitor the behavior of the LANSCOPE agent processes. Alert on any anomalous behavior, such as spawning shells, writing new executables to disk, or making outbound connections to unknown C2 servers.
- D3FEND Techniques: Employ
D3-NTA: Network Traffic Analysisto spot the malicious packets andD3-PA: Process Analysisto detect anomalous agent behavior.
Remediation Steps
- Patch Immediately: The primary remediation is to upgrade all LANSCOPE agents and management servers to the latest patched versions provided by Motex.
- Network Segmentation: As a compensating control, limit network access to the ports used by the LANSCOPE agents. Ensure that only the management server can communicate with the agents on these ports and that endpoints cannot communicate with each other on them.
- Threat Hunting: Proactively hunt for signs of compromise on systems running vulnerable versions, looking for suspicious files, processes, and network connections.
- D3FEND Countermeasures:
- The definitive fix is
D3-SU: Software Update. D3-ITF: Inbound Traffic Filteringon host-based firewalls can help restrict communication to the vulnerable agent ports.
- The definitive fix is
Timeline of Events
Article Updates
November 2, 2025
Severity increasedChina-linked 'Bronze Butler' APT identified exploiting CVE-2025-61932 as a zero-day since mid-2025, deploying 'Gokcpdoor' backdoor for espionage.
New intelligence attributes the active exploitation of CVE-2025-61932 to the China-linked 'Bronze Butler' (Tick) APT group. Researchers confirm the group exploited this vulnerability as a zero-day, initiating attacks in mid-2025, months before a patch was available. The APT deployed an updated 'Gokcpdoor' backdoor for data theft and remote control, utilizing tools like 'goddi' for credential dumping and 7-Zip for archiving. This attribution to a sophisticated nation-state actor significantly elevates the threat level and highlights the advanced nature of the ongoing campaign.
Update Sources:
Timeline of Events
Active abuse of CVE-2025-61932 reportedly began after this date in Japan.
CISA adds CVE-2025-61932 to its KEV catalog.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.