ScoringMathTea is a remote access trojan used by Lazarus in Operation DreamJob cyberespionage campaigns and described as giving attackers full control of compromised machines. In the Gotta Fly activity, Lazarus targeted companies supplying unmanned-aerial-vehicle technology to Ukraine, likely seeking proprietary information and manufacturing know-how. Initial access relied on social engineering around fraudulent job offers, with trojanized open-source GitHub projects, a decoy job-description document, and a trojanized PDF reader. The campaigns also introduced libraries for DLL proxying to improve evasion. ScoringMathTea has been observed since late 2022 and communicates with compromised servers, whose server components are commonly placed under WordPress directories for design templates or plugins.