Loading malware…
PAKLOG is a Windows keylogger associated with the China-aligned Mustang Panda espionage cluster. It is designed to capture user keystrokes and monitor clipboard activity using standard Windows APIs, then encode the collected data and store it locally for later theft by companion tooling rather than exfiltrating it itself. Reported functionality includes low-level keyboard interception, collection of clipboard contents including paste operations, logging of timestamps, and recording contextual information such as the active foreground window and related text to enrich captured input.
Operationally, PAKLOG has been observed delivered through DLL side-loading, using legitimate signed executables to load a malicious DLL. This tradecraft aligns with Mustang Panda’s long-running preference for abusing trusted binaries for execution and defense evasion. The malware has been described as part of a broader Mustang Panda toolkit that also includes backdoors, proxying utilities, and EDR-evasion components, indicating its role as a focused collection module within larger post-compromise intrusion chains.
PAKLOG targets Windows systems and is primarily suited to espionage operations against organizations of intelligence interest to Mustang Panda, including government, military, NGO, and regional targets in East Asia and nearby regions. Its main purpose is credential and information collection through user-input surveillance and clipboard theft, with local staging of encoded logs for subsequent operator retrieval or exfiltration by other malware components.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...debuting four new attack tools: two keyloggers (PAKLOG and CorKLOG)...
“PAKLOG is a keylogger… monitor keystrokes and clipboard data and employs a custom character encoding scheme to obfuscate the log data.”
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
"PAKLOG has used Windows API SetWindowsHookExW with idHook set to WH_KEYBOARD_LL ... to support its keylogging functions"
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
... PAKLOG ... (v1.0) ...
PAKLOG (v1.0)
A keylogger used by Mustang Panda to capture keystrokes and sensitive information from compromised systems.
Keylogger tool used by Mustang Panda to capture keystrokes and exfiltrate sensitive information from targeted systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.