S1233 PAKLOG

malwareEnterprise

platformsWindows

also known asPAKLOG

PAKLOG is a keylogger known to be leveraged by Mustang Panda and was first observed utilized in 2024. PAKLOG is deployed via a RAR archive (e.g., key.rar), which contains two files: a signed, legitimate binary (PACLOUD.exe) and the malicious PAKLOG DLL (pa_lang2.dll). The PACLOUD.exe binary is used to side-load the PAKLOG DLL which starts with the keylogger functionality.

techniques used (10)

ATT&CK techniques this enables or maps to.

T1010Application Window Discovery
T1027.013Encrypted/Encoded File
T1056.001Keylogging
T1057Process Discovery
T1074.001Local Data Staging
T1106Native API
T1115Clipboard Data
T1124System Time Discovery
T1553.002Code Signing
T1574.001DLL

used by groups (1)

Threat groups associated with this.

G0129Mustang Panda

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan