SmallTiger is a C++ backdoor and downloader used in attacks on South Korean defense contractors, automotive-parts manufacturers, semiconductor manufacturers, and other businesses. It has been delivered as SmallTiger.dll during lateral movement, connects to command-and-control infrastructure, and downloads and launches payloads in memory. Samples use layered obfuscation and have appeared as executables packed with Themida or VMProtect. Campaigns also compromised company software-updater or asset-management systems to replace legitimate update components and propagate SmallTiger across internal networks.