Full Report
The threat group targeted a LANSCOPE zero-day vulnerability (CVE-2025-61932)Categories: Threat ResearchTags: BRONZE BUTLER, china, featured, Japan, LANSCOPE, Tick, vulnerabiity
Analysis Summary
# Incident Report: BRONZE BUTLER Exploitation of LANSCOPE Zero-Day
## Executive Summary
The threat group BRONZE BUTLER conducted a targeted attack leveraging a zero-day vulnerability (CVE-2025-61932) in LANSCOPE asset management software. This initial access technique allowed the threat actor to compromise systems, likely within Japanese organizations, and deploy custom malware such as the 'goddi' tool. The primary focus appears to be espionage or data theft, utilizing sophisticated command and control infrastructure.
## Incident Details
- **Discovery Date:** Not explicitly stated in the snippet (Implied post-exploitation discovery).
- **Incident Date:** Not explicitly stated in the snippet (Focus is on the TTPs).
- **Affected Organization:** Organizations utilizing LANSCOPE asset management software, primarily in Japan.
- **Sector:** Unspecified, but linked to asset management software users (likely IT/Enterprise sectors).
- **Geography:** Japan.
## Timeline of Events
### Initial Access
- **Date/Time:** Unknown.
- **Vector:** Exploitation of LANSCOPE zero-day vulnerability, **CVE-2025-61932**.
- **Details:** This vulnerability in the asset management software provided the initial entry point into target environments.
### Lateral Movement
- **Details:** The threat actor utilized custom tooling, evidenced by the deployment of the 'goddi' tool (SHA1: `0d2b546b73c010e30b1`). The use of Command and Control (C2) infrastructure suggests post-exploitation activity and establishment of remote access.
### Data Exfiltration/Impact
- **Details:** The deployment tools, including 'goddi', and communication with C2 servers (e.g., at `38[.]54[.]56[.]57`) indicate successful compromise post-initial access, suggesting data collection or espionage objectives.
### Detection & Response
- **Details:** Detection was enabled by analyzing connections to known C2 IP addresses associated with BRONZE BUTLER activity. Response actions are implied via the documentation of IOCs.
## Attack Methodology
- **Initial Access:** Exploitation of LANSCOPE Zero-Day (CVE-2025-61932).
- **Persistence:** Unknown, but custom tools like 'goddi' were deployed, suggesting custom persistence mechanisms were established.
- **Privilege Escalation:** Unknown.
- **Defense Evasion:** Unknown, but the use of custom tools by a known advanced group suggests evasion techniques were employed.
- **Credential Access:** Unknown.
- **Discovery:** Unknown, but implied by C2 communication.
- **Lateral Movement:** Implied by C2 communication patterns and tool deployment.
- **Collection:** Unknown, focused tactics were not detailed in the summary.
- **Exfiltration:** Implied, supported by C2 infrastructure setup.
- **Impact:** Unauthorized access and execution of remote access tools (Havoc C2 used alongside Gokcpdoor variants).
## Impact Assessment
- **Financial:** Not available.
- **Data Breach:** Likely sensitive network or organizational data targeted, specific volume unknown.
- **Operational:** Potential disruption due to asset management system compromise and subsequent malware execution.
- **Reputational:** High risk, as the exploitation targets known software vendors and sophisticated threat actors are involved.
## Indicators of Compromise
- **Network Indicators (Defanged):**
- C2 Server 1 (Gokcpdoor): `38[.]54[.]56[.]57` (TCP Port 443)
- C2 Server 2 (Havoc C2): `38[.]54[.]88[.]172` (TCP Port 443)
- Associated IPs: `38[.]54[.]56[.]10`, `38[.]60[.]212[.]85`, `108[.]61[.]161[.]118`
- **File Indicators:**
- Goddi Tool (winupdate.exe): SHA1: `0d2b546b73c010e30b1`
- Goddi Tool (winupdate.exe): SHA256: `704e697441c0af67423458a99f30318c57f1a81c4146beb4dd1a88a88a8c97c3`
- **Behavioral Indicators:** Communication to TCP 443 on the listed C2 IPs following exploitation of LANSCOPE.
## Response Actions
- **Containment Measures:** (Not explicitly detailed; assumed patch/isolation measures upon discovery of CVE-2025-61932 exploitation).
- **Eradication Steps:** (Not detailed; likely included removing 'goddi' and associated C2 implants).
- **Recovery Actions:** (Not detailed).
## Lessons Learned
- **Key Takeaways:** Zero-day exploitation of commonly used enterprise software (asset management tools) represents a critical entry vector for sophisticated threat groups like BRONZE BUTLER.
- **What could have been done better:** Rapid patching/virtual patching of CVE-2025-61932 upon disclosure or evidence of in-the-wild use was critical to stopping initial compromise.
## Recommendations
- **Prevention Measures for Similar Incidents:**
1. Immediately apply patches for LANSCOPE software addressing CVE-2025-61932.
2. Implement strict network monitoring around critical asset management systems for unexpected outbound connections, especially on non-standard ports or connections to known threat actor infrastructure.
3. Enhance detection capabilities specifically targeting known BRONZE BUTLER tool signatures ('goddi') and associated C2 protocols.