ScoringMathTea
ScoringMathTea is a remote access trojan (RAT) associated with the North Korea-aligned Lazarus Group and repeatedly linked to Operation DreamJob. It has been used since at least late 2022 and was publicly documented by Kaspersky in April 2023; Microsoft reported on it in October 2023 under the name ForestTiger. The malware has been observed in espionage-focused campaigns targeting defense and aerospace-related organizations, including European defense companies, UAV/drone-related firms, an Indian technology company, a Polish defense company, a British industrial automation company, and an Italian aerospace company.
In the reported 2025 activity, Lazarus used fake recruiter/job-offer lures and decoy job-description documents, including trojanized PDF readers and other trojanized open-source software delivered via GitHub-hosted projects, to infect victims. Observed trojanized components included MuPDF reader, TightVNC Viewer, Notepad++ plugins, WinMerge plugins, libpcre, DirectX wrapper-based loaders, QuanPinLoader, BinMergeLoader, and a loader with the internal name DroneEXEHijackingLoader.dll. ESET reported that the campaign targeted three European defense-sector companies, including organizations involved in UAV technology and military equipment used in Ukraine, and assessed the likely objective as theft of proprietary information and manufacturing know-how.
ScoringMathTea provides attackers full or interactive control over compromised systems. Reported functionality includes roughly 40 commands covering file and process manipulation, system information collection, TCP/network connectivity, command execution, configuration changes, and downloading/executing additional payloads. Reporting also describes ScoringMathTea as using a reflective plugin loader and additional DLL plug-ins, indicating modular in-memory extension of capabilities. One report notes use of custom polyalphabetic cryptography.
The surrounding intrusion chain used droppers/loaders/downloaders that decrypted stages with AES-128 or ChaCha20 and loaded them in memory via MemoryModule routines; in observed cases, the main ScoringMathTea payload was not present on disk in unencrypted form. Command-and-control communications were reported to use compromised servers, with server-side components often stored in WordPress theme or plugin directories. Published C2 indicators mentioned in the content include coralsunmarine[.]com (23.111.133[.]162), kazitradebd[.]com (104.21.80[.]1), and oldlinewoodwork[.]com (70.32.24[.]131).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus Group’s New ScoringMathTea RAT Uses Reflective Plugin Loader and Custom Polyalphabetic Crypto for Espionage
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote Access Trojan (RAT) attributed in the content to Lazarus Group, described as using a reflective plugin loader and custom polyalphabetic cryptography to support espionage activity.
ScoringMathTea is a new remote access trojan (RAT) linked to the Lazarus Group, likely used for cyber-espionage.
Malware used in Lazarus/Operation Dream Job recruiter-themed phishing to infect targets.
Malware referenced as deployed in a Lazarus-linked Operation DreamJob wave targeting UAV-related companies, delivered after trojanizing open-source GitHub projects; also associated with DLL proxying tradecraft in the described evolution.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.