# LANSCOPE Endpoint Manager RCE exploited in wild

Published: 2025-10-19 · Severity: critical
Canonical: https://vorant.io/reports/1b4f9128-5cb9-56a5-aa46-5643aac3cc24/lanscope-endpoint-manager-rce-exploited-in-wild

> A critical RCE flaw in MOTEX LANSCOPE Endpoint Manager on-premises (CVE-2025-61932) is being exploited; customers report malicious packets from external sources.

MOTEX Corporation's LANSCOPE Endpoint Manager on-premises edition contains a critical vulnerability (CVE-2025-61932) stemming from improper source verification of communication channels. The flaw allows remote attackers to execute arbitrary code by sending specially crafted packets to affected systems. Japan's IPA reports that the vendor has confirmed instances of customers receiving malicious packets from external sources, indicating active exploitation in the wild.

The vulnerability affects LANSCOPE Endpoint Manager on-premises version 9.4.7.1 and earlier, specifically the Client Program (MR) and Detection Agent (DA) components. The cloud version of the product is not affected. With a CVSS v3 score of 9.8, this is rated as a critical severity issue requiring immediate attention.

MOTEX has released patches and workarounds for affected customers. Organizations running vulnerable versions should immediately apply the latest updates or implement the vendor-provided workarounds to mitigate the risk of remote code execution.

## Mentioned in this report

- Vulnerabilities: CVE-2025-61932 (KEV)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by LANSCOPE Endpoint Manager Agent (MR/DA)

ATT&CK: T1203

Detects the LANSCOPE Endpoint Manager Client Program (MR) or Detection Agent (DA) process spawning a shell or scripting interpreter, consistent with post-exploitation of CVE-2025-61932 remote code execution via crafted packets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by LANSCOPE Endpoint Manager Agent
id: 62e73caa-1a8c-51f9-a2cf-d3fd56fc08e0
status: experimental
description: 'Detects a command shell or scripting interpreter spawned by the LANSCOPE
  Endpoint Manager Client Program (MR) or Detection Agent (DA) service processes.
  This pattern is consistent with exploitation of CVE-2025-61932, an unauthenticated
  RCE in LANSCOPE Endpoint Manager on-premises (<=9.4.7.1) triggered by specially
  crafted packets reaching the MR/DA listener processes.

  '
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - \LanScope\
    - \MOTEX\
    ParentImage|endswith:
    - \MR.exe
    - \DA.exe
    - \MRAgent.exe
    - \DAAgent.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \powershell_ise.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate LANSCOPE agent maintenance scripts or vendor-provided diagnostic tools
  invoked by administrators
- Software update routines that call helper scripts from the LANSCOPE installation
  directory
level: high
```

### LANSCOPE Endpoint Manager Agent Process Initiating Outbound Network Connection After Exploitation

ATT&CK: T1071

Detects the LANSCOPE Endpoint Manager Client Program (MR) or Detection Agent (DA) process initiating outbound network connections to non-management infrastructure, which may indicate command-and-control activity following exploitation of CVE-2025-61932. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LANSCOPE Endpoint Manager Agent Process Initiating Outbound Connection
id: b9bc1540-d88c-58f4-80c1-078d324cff9d
status: experimental
description: 'Detects the LANSCOPE Endpoint Manager Client Program (MR) or Detection
  Agent (DA) process making outbound network connections. Following exploitation of
  CVE-2025-61932, an attacker gaining code execution within these agent processes
  may use the compromised process to establish command-and-control or exfiltration
  channels. Baseline normal LANSCOPE-to-management-server communication before enabling
  in production, since legitimate check-in traffic will also match; consider tuning
  against known management server IP/port ranges.

  '
references:
- https://www.ipa.go.jp
author: Vorant
tags:
- attack.t1071
- attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
    - \LanScope\
    - \MOTEX\
    Image|endswith:
    - \MR.exe
    - \DA.exe
    - \MRAgent.exe
    - \DAAgent.exe
    Initiated: 'true'
  condition: selection
falsepositives:
- Normal LANSCOPE agent check-in or update communication with the legitimate on-premises
  management server
- Scheduled inventory/asset reporting traffic from the agent to internal collection
  servers
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251020-jvn.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1b4f9128-5cb9-56a5-aa46-5643aac3cc24/lanscope-endpoint-manager-rce-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup