ctrlINT What the industry said about every indicator, with the quote

ForestTigerMalware

  • scoringmathtea

According to ESET Research, ScoringMathTea is a RAT that offers the attackers full control over the compromised machine. Its first appearance dates to late 2022, when its dropper was uploaded to VirusTotal.From MISP Galaxy

Last reported 3 days ago, by Kaspersky Securelist2 reports

ATT&CK techniques

5 techniques · each with the sentence it comes from
  1. T1014Rootkit

    “…ed CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit.”

    Check Point ResearchVendor
  2. T1213.005Messaging Applications

    “… that the threat actor likely approached targets through professional networking platforms such as LinkedIn, or directly through messaging applications.”

    Check Point ResearchVendor
  3. T1505.003Web Shell

    “… leveraged these credentials to authenticate to the affected Roundcube instances before exploiting CVE-2025-49113 to deploy RelayShell web shells, which subsequently serve as a C2 relay mechanism.”

    Check Point ResearchVendor
  4. T1543.003Windows Service

    “…echHub in the chain: an in‑memory version, a simple DLL side‑loading version, and a DLL side‑loading version that uses a registered Windows service.”

    Kaspersky SecurelistVendor
  5. T1564.003Hidden Window

    “OPEN|<exe> [args]Process creationLaunches an executable with arguments in a hidden window with no console.”

    Check Point ResearchVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “…nt is that the recent Dream Job campaign employs an updated malware chain that, since around 2024, has primarily involved MISTPEN and ForestTiger rather than the earlier arsenal that included tools such as TechHub and Cubridge.”

    Kaspersky SecurelistVendor
    Operation FlashHole: Lazarus breaks security, defies control

  2. “Backdoor Deployment: The final backdoor delivered by MISTPEN is the ForestTiger backdoor, a well-documented malware family widely attributed to the Lazarus threat group.”

    Check Point ResearchVendor
    Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with ForestTiger here?
No account needed. We do not store your IP address.