Loading threat actor…
DragonBreath, also known as Dragon Breath, APT-Q-27, and Golden Eye Dog, is a China-linked, financially motivated threat actor active since at least 2020. It targets online gaming and gambling businesses and Chinese-speaking users, including overseas Chinese communities. Its targeting includes China, Taiwan, Hong Kong, Japan, Singapore, and the Philippines. The group uses search-engine result poisoning, social engineering, and trojanized software installers to distribute malware, with lures impersonating browsers, collaboration applications, messaging clients, and VPN software. DragonBreath deploys modified variants of the open-source gh0st RAT through multi-stage infection chains, including its RoningLoader loader. Campaigns use MSI and NSIS packages that install legitimate software alongside malicious components. Its techniques include double DLL side-loading, phantom DLL side-loading, in-memory shellcode execution, and injection into trusted Windows processes. Persistence mechanisms include Windows services and watchdog scripts. The actor also uses Cobalt Strike and abuses code-signing certificates and signed kernel drivers to support malware execution and defense evasion. RoningLoader combines redundant defense-impairment techniques, including kernel-level termination of security processes, firewall manipulation, UAC disabling, malicious unsigned Windows Defender Application Control policies, and Protected Process Light abuse to disable Microsoft Defender. It also targets Chinese security products from Qihoo 360, Huorong, Kingsoft, and Tencent. Its gh0st RAT variants provide encrypted command-and-control communications, host and security-product reconnaissance, remote command execution, payload delivery, process injection, event-log clearing, keylogging, clipboard collection and hijacking, and active-window logging. DragonBreath has also been associated with DDoS attacks.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families Mallory has associated with this actor across public reporting.
40 indicators attributed to this actor. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.