MITRE ATT&CKsoftware (malware)
S1235 CorKLOG
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2025-09-12
Description
CorKLOG is a keylogger known to be leveraged by Mustang Panda and was first observed utilized in 2024. CorKLOG is delivered through a RAR archive (e.g., src.rar), which contains two files: an executable (lcommute.exe) and the CorKLOG DLL (mscorsvc.dll). CorKLOG has established persistence on the system by creating services or with scheduled tasks.
Related
Uses · MITRE ATT&CK (8)
- T1027.013 Encrypted/Encoded File sub-technique
- T1074.001 Local Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1056.001 Keylogging sub-technique
- T1553.002 Code Signing sub-technique
- T1543.003 Windows Service sub-technique
- T1053.005 Scheduled Task sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
Referenced by MITRE ATT&CK · uses (1)
- G0129 Mustang Panda group
References
- https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2 Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025