Deployment of the ScoringMathTea Remote Access Trojan (RAT), which allows full control over compromised machines.
Primarily achieved through social engineering and "Operation DreamJob" tactics—sending trojanized PDF readers hidden in faux job offers.
Active scanning observed against government infrastructure in 155 countries as of early 2026. tarea692
The report details the tactics, techniques, and procedures ( TTPs ) of state-aligned cyber-espionage groups.
💡 If you are analyzing this for a security audit, focus on credential theft and persistence through enterprise services , as these are the preferred repeatable techniques for these actors. Threat Intelligence Report: August 2025 - Anthropic Deployment of the ScoringMathTea Remote Access Trojan (RAT),
Recent iterations of similar reports focus on Government Ministries , Critical Infrastructure , and the UAV (Unmanned Aerial Vehicle) sector.
Recent reports highlight the use of AI-supported tools (like Claude Code) for reconnaissance and data exfiltration to increase efficiency. 🌍 Global Impact The report details the tactics, techniques, and procedures
High-confidence attribution points to groups like Lazarus (North Korea) and various Iranian threat actors (e.g., APT39, Rana). 🛠️ Key Malware & Tactics