Mustang Panda: PAKLOG, CorKLOG, and SplatCloak

Technical analysis identifies Mustang Panda tooling comprising two keyloggers (PAKLOG and CorKLOG) and a kernel-level driver (SplatCloak) dropped by SplatDropper. PAKLOG and CorKLOG capture keystrokes and clipboard data (stored with simple encoding or RC4) and are delivered via RAR archives that use legitimate signed binaries to sideload malicious DLLs; CorKLOG implements persistence via services or scheduled tasks. SplatCloak is a revoked-certificate-signed Windows kernel driver that the dropper writes and runs as a service, and its primary function is to locate and unregister or disable Windows Defender and Kaspersky callback/notification routines to evade EDR; the report includes implementation details (API resolution, hashing, certificate checks), file artifacts, and a certificate thumbprint.