ASEC observed SmallTiger malware in attacks against South Korean defense contractors, automobile parts makers, and semiconductor manufacturers. The initial access vector was not identified, but the actor moved laterally inside company networks and abused software updater programs to propagate malware. November 2023 cases combined Kimsuky-like tooling such as MultiRDP and Meterpreter with DurianBeacon, a RAT previously tied to Andariel; later activity from February through May 2024 shifted to the SmallTiger downloader. The campaign also used Mimikatz, ProcDump LSASS dumping, browser credential theft tools, mshta and JavaScript execution, alternate data streams, GitHub-hosted payload delivery, and C2-driven in-memory payload execution.