ForestTiger is a Windows backdoor installed during a 2026 Lazarus Operation Dream Job campaign against defense, aerospace, and aviation organizations. MISTPEN used Microsoft Graph and attacker-controlled OneDrive files to collect host data and screenshots, establish persistence, deliver privilege-escalation tooling, and install ForestTiger. The campaign confirms ForestTiger's role as a final backdoor, while its own command set and communications remain separately unresolved.