PAKLOG

Executive Summary

PAKLOG is a stealthy Windows keylogger that leverages side‑loaded DLLs inside legitimate signed binaries to harvest keystrokes. First seen in 2024, it has been linked to the Mustang Panda threat group and is distributed via RAR archives. Its primary aim is credential theft, posing substantial risk to organizational user data and potentially enabling broader lateral movement.

PAKLOG is a Windows‑targeted keylogging implant that was first documented in 2024 and has been linked to the Mustang Panda threat activity. The malware typically arrives as a compressed archive (for example, key.rar) containing two components: a signed and otherwise legitimate executable named PACLOUD.exe and an injected DLL file called pa_lang2.dll. When PACLOUD.exe is executed it performs a side‑loading technique that loads pa_lang2.dll into its process space, thereby enabling the illicit keylogger code to run under the guise of a trusted binary. Once loaded, PAKLOG continuously captures user keystrokes and stores them in memory or on disk for later exfiltration. The implant avoids standard file integrity checks by virtue of using an unsigned yet signed legitimate executable, helping it evade heuristics that flag rogue DLLs. By blending into routine Windows processes, the malware can persist across reboots without raising immediate suspicions. The combination of side‑loading, cryptographically signed binaries and covert keystroke capture places PAKLOG among high‑impact credential‑stealing threats in contemporary threat landscapes, particularly within supply‑chain or lateral movement scenarios employed by advanced persistent actors.

Key Capabilities

• Side‑loads a malicious DLL into a signed legitimate EXE
• Captures keystrokes and stores them locally
• Evades detection by using signed binaries
• Distributes via RAR archives

ATT&CK Techniques

Recommended Actions

• Implement anti‑malware solutions that flag unknown DLL injections Monitor for abnormal execution of PACLOUD.exe or unexpected DLLs loading Block inbound connections from known malicious IP ranges used by Mustang Panda Apply application whitelisting to prevent sideloaded DLL execution

Suggested Tags