TigerRAT is a custom Windows remote-access Trojan used by Onyx Sleet in intelligence-gathering operations. It has been deployed after exploitation of vulnerable software, including Log4j-related compromises, and appeared in attacks against South Korean defense organizations. As a backdoor it gives operators sustained remote access and supports command execution and collection on compromised systems. Reporting places it alongside SmallTiger, LightHand, and ValidAlpha in the group’s malware arsenal, with versions observed over several years.