SmallTiger

SmallTiger is a Windows malware family used in intrusions targeting South Korean organizations, including defense contractors, semiconductor manufacturers, and automotive parts companies. It has been associated with North Korean activity, including reporting that links its use to APT45 (Andariel), and it appeared in operations that also showed overlaps with Kimsuky tradecraft. SmallTiger functions as a downloader that contacts command-and-control infrastructure, retrieves additional payloads, and executes them directly in memory. This behavior supports staged post-compromise operations while reducing on-disk exposure.

Observed campaigns using SmallTiger involved lateral propagation inside victim environments through abuse of enterprise software update mechanisms. In later activity, operators also used script-based staging to fetch and launch SmallTiger, including execution chains involving mshta, malicious JavaScript, alternate data streams, and rundll32. Distribution of additional SmallTiger payloads was also observed through GitHub-hosted content. The malware was deployed as part of broader intrusion sets that included credential theft and follow-on tooling such as LSASS dumping utilities, browser credential theft tools, remote administration utilities, and other post-exploitation frameworks.

Operationally, SmallTiger appears to serve as a lightweight in-memory delivery component within espionage-focused campaigns rather than as the final objective payload itself. Its role is to establish contact with attacker-controlled infrastructure, download secondary malware, and facilitate continued access and follow-on actions on compromised Windows systems. The targeting and surrounding tradecraft indicate use in sustained intelligence collection and internal network operations against strategically important South Korean industries.