SplatCloak

Malware & Tools · SplatCloak

· MalwareS1234 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

SplatCloak is a malware that disables EDR-related routines used by Windows Defender and Kaspersky to aid in evading detection. SplatCloak has been deployed by SplatDropper and is known to be leveraged by Mustang Panda since 2025.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)

Tactic Coverage

discovery (3)stealth (1)execution (1)defense impairment (1)

Used By (1 groups)

G0129Mustang PandaTA416, RedDelta

Techniques (6)

T1036.001Invalid Code Signature

stealth

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1106Native API

execution

T1518.001Security Software Discovery

discovery

T1685Disable or Modify Tools

defense impairment

References

https://attack.mitre.org/software/S1234 https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2