ASEC reports that Andariel, described as linked to or subordinate to Lazarus, abused a Korean asset management program and poorly managed MS-SQL servers to deploy TigerRat, NukeSped variants, Black RAT, Lilith RAT, and a Go downloader. The observed targets include Korean telecommunications and semiconductor manufacturing environments, matching prior Andariel targeting. The asset management program launched PowerShell and mshta download chains, while the MS-SQL activity used PrintSpoofer for privilege escalation and installed backdoors. The malware set up persistence through scheduled tasks, collected host and credential information, used tools such as CredentialsFileView and Network Password Recovery, and created a hidden "black$" account to support RDP access and lateral movement.