SplatCloak
SplatCloak is a malware that disables EDR-related routines used by Windows Defender and Kaspersky to aid in evading detection. SplatCloak has been deployed by SplatDropper and is known to be leveraged by Mustang Panda since 2025.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1083 | File and Directory Discovery |
SplatCloak has used Windows API to identify files associated with Windows Defender and Kaspersky.[1] |
|
| Enterprise | T1562 | .001 | Impair Defenses: Disable or Modify Tools |
SplatCloak has identified and disabled API callback features of Windows Defender and Kaspersky.[1] |
| Enterprise | T1036 | .001 | Masquerading: Invalid Code Signature |
SplatCloak has used a revoked certificate to exploit Windows driver execution policy where certificates issued before a specific date could still load.[1] |
| Enterprise | T1106 | Native API |
SplatCloak has utilized Native Windows API calls dynamically through |
|
| Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
SplatCloak has identified drivers of AV solutions by searching for related filenames, keywords and signed certificates.[1] |
| Enterprise | T1082 | System Information Discovery |
SplatCloak has collected the Windows build number using the windows kernel API |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0129 | Mustang Panda |