Analysis of Attack Cases Against Korean Solutions by the Andariel Group (SmallTiger)

Description

The Andariel group has been targeting various South Korean software solutions, particularly asset management and document management systems. Recent attacks involve the installation of SmallTiger malware, often through exploiting vulnerabilities in outdated software versions. In asset management solution attacks, the group uses ModeLoader and SmallTiger, sometimes replacing update programs to distribute malware. They also employ keyloggers and enable RDP access for future intrusions. A new attack vector involves a Korean document management solution, where outdated Apache Tomcat servers are exploited. The attackers use system information queries, Advanced Port Scanner, and attempt to install web shells. Corporate security managers are advised to strengthen monitoring of centralized management solutions, apply security patches, and keep systems updated to prevent malware infections.