Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger)

ASEC identified renewed Andariel activity targeting Korean asset-management and document-management solutions, delivering SmallTiger and ModeLoader, using a unique keylogger that stores keystrokes in MsMpLog.tmp, enabling RDP access and creating hidden backdoor accounts, and deploying web shells via outdated Apache Tomcat instances; the report provides IOCs (45.61.148.153, http://45.61.148.153/pizza.jsp, and several MD5 hashes) and recommends patching and enhanced monitoring.