MITRE ATT&CKsoftware (malware)

S1233 PAKLOG

Published 2025-09-12 Modified 2025-10-21 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2025-09-12

Description

PAKLOG is a keylogger known to be leveraged by Mustang Panda and was first observed utilized in 2024. PAKLOG is deployed via a RAR archive (e.g., key.rar), which contains two files: a signed, legitimate binary (PACLOUD.exe) and the malicious PAKLOG DLL (pa_lang2.dll). The PACLOUD.exe binary is used to side-load the PAKLOG DLL which starts with the keylogger functionality.

Related

Uses · MITRE ATT&CK (10)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1574.001 DLL sub-technique
  • T1056.001 Keylogging sub-technique
  • T1553.002 Code Signing sub-technique
  • T1010 Application Window Discovery technique
  • T1057 Process Discovery technique
  • T1106 Native API technique
  • T1115 Clipboard Data technique
  • T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • G0129 Mustang Panda group

References