MITRE ATT&CKsoftware (malware)

S1234 SplatCloak

Published 2025-09-12 Modified 2025-10-21 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2025-09-12

Description

SplatCloak is a malware that disables EDR-related routines used by Windows Defender and Kaspersky to aid in evading detection. SplatCloak has been deployed by SplatDropper and is known to be leveraged by Mustang Panda since 2025.

Related

Uses · MITRE ATT&CK (6)

  • T1685 Disable or Modify Tools technique
  • T1518.001 Security Software Discovery sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

  • G0129 Mustang Panda group

References