ThreatRay links malware samples from Malwarebytes, Kaspersky, and KrCERT reporting on South Korea-focused activity to shared TigerDownloader and TigerRAT families. The earlier reports attributed the activity to Lazarus or more specifically Andariel, a Lazarus subgroup, while KrCERT named the ByteTiger operation and introduced the TigerDownloader and TigerRAT labels. Code-reuse analysis found common packer functionality across 27 packed samples, including payload mapping, anti-analysis checks, unpacking, dynamic Windows API resolution, and junk-code insertion for detection evasion. The shared packing scheme used XOR decryption with a 16-byte key and variants based on Base64 encoding and PE payload storage, while the unpacked payloads clustered into downloader and RAT families with multiple variants. The findings help defenders connect malicious documents, compromised-website delivery, downloader stages, RAT payloads, and reported ransomware deployment under a clearer Andariel tooling map.