ForestTiger
Aliases: ScoringMathTea
- First seen
- 2022-10-15 00:00:00
- Malware type
- rat, spyware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:45:52
Targeted industries: government-and-public-sector financial-services
Targeted regions: country_code:us country_code:cn
Context
ForestTiger is an advanced persistent threat group known for using remote access trojans and spyware in their campaigns. It primarily targets government and financial sectors, focusing on cyber espionage activities.
Detection coverage
- 1 YARA rules
Exploited vulnerabilities
- CVE-2023-42793 (vulnerability)
Detection rules
- SEKOIA_Backdoor_Win_Foresttiger (yara-rule)
Reports & references
- Microsoft — Multiple North Korean Threat Actors Exploiting The Teamcity Cve 2023 42793 Vulnerability (report)
- virusbulletin.com — Lazarus Campaigns And Backdoors In 2022 2023 (report)
- Kaspersky — 109490 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Forest Tiger (report)