Lazarus Group’s New ScoringMathTea RAT Uses Reflective Plugin Loader and Custom Polyalphabetic Crypto for Espionage

A new technical deep-dive into ScoringMathTea reveals a sophisticated Lazarus Group remote access Trojan written in C++ that includes a fully manual reflective plugin loader to evade detection. The analysis describes a modular architecture with a reflective DLL injection system, dynamic API resolution via a custom hashing algorithm, and a polyalphabetic substitution cipher with chaining that decrypts strings at runtime using a bespoke 64-character alphabet.

It notes that the malware hides its C2 infrastructure with stack strings and maintains multiple C2 slots, though only one URL was active in the sample analysed. The beaconing is persistent at a 60‑second interval, and communications travel over HTTP/HTTPS with TEA/XTEA-based decryption, base64 decoding, and optional compression before command parsing. The sample was packed as a DLL, and the operator can load and execute plugins in memory, a capability highlighted by the researcher 0x0d4y.

According to ESET’s October 2025 report, this activity aligns with Lazarus’s broader DreamJob cluster, nicknamed Gotta Fly, targeting UAV technology developers in Ukraine.