PAKLOG
Software · ATTACK:enterprise:S1233
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1233",
"title": "PAKLOG",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1233",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--0bf64997-7ce1-43e5-b01a-bcd2bf5dc87f",
"external_id": "S1233",
"domain": "enterprise",
"created": "2025-09-12T15:08:09.556Z",
"modified": "2025-10-21T16:53:47.769Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
"url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12fbb06a-3bf9-4f7c-8385-8240859c7932
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4484ae6e-e546-4033-81c1-fe824f4f3ed3
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1115
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--601ae14e-841f-4c18-bbe5-b570cb7d8d26
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S1233
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76a98773-f360-4553-b901-bfe14584096c
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--823efa1c-11e9-4ed3-9264-40ab74f1d0f9
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ffa65ef-05b7-49bb-ba1e-bbf5d1dc5857
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be20956b-6103-4bfc-a7c4-7e61cbc8cbcd
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca882933-d3ee-4909-ad5b-628ed7e00709
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3674f09-f242-4821-bab6-c9c322646735
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--edb14d5c-992a-4cd0-a0f3-b2db3f6b813c
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd5f7b22-1af7-40f7-a43f-47fd6352c634
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025