PAKLOG

MITRE ATT&CK: S1233 View on attack.mitre.org

Aliases: PAKLOG

Malware type
keylogger
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 15:31:54

Targeted industries: government-and-public-sector education-and-nonprofits

Targeted regions: country_code:cn country_code:vn

Context

PAKLOG is a keylogger known to be leveraged by Mustang Panda and was first observed utilized in 2024. PAKLOG is deployed via a RAR archive (e.g., key.rar), which contains two files: a signed, legitimate binary (PACLOUD.exe) and the malicious PAKLOG DLL (pa_lang2.dll). The PACLOUD.exe binary is used to side-load the PAKLOG DLL which starts with the keylogger functionality.

Detection coverage

  • 116 Sigma rules

Malware & tools used

  • Encrypted/Encoded File (attack-pattern)
  • Keylogging (attack-pattern)
  • Clipboard Data (attack-pattern)
  • Native API (attack-pattern)
  • Code Signing (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Application Window Discovery (attack-pattern)
  • DLL (attack-pattern)
  • Process Discovery (attack-pattern)
  • System Time Discovery (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — S1233 (report)
  • zscaler.com — Latest Mustang Panda Arsenal Paklog Corklog And Splatcloak P2 (report)

External references