S1234 SplatCloak

malwareEnterprise

platformsWindows

also known asSplatCloak

SplatCloak is a malware that disables EDR-related routines used by Windows Defender and Kaspersky to aid in evading detection. SplatCloak has been deployed by SplatDropper and is known to be leveraged by Mustang Panda since 2025.

techniques used (6)

ATT&CK techniques this enables or maps to.

T1036.001Invalid Code Signature
T1082System Information Discovery
T1083File and Directory Discovery
T1106Native API
T1518.001Security Software Discovery
T1685Disable or Modify Tools

used by groups (1)

Threat groups associated with this.

G0129Mustang Panda

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan