Loading malware…
RONINGLOADER is a multi-stage Windows malware loader used by Dragon Breath, also tracked as APT-Q-27 and Golden Eye Dog, to deploy a modified Gh0st RAT. Documented in 2025, its campaigns primarily target Chinese-speaking users through trojanized MSI and NSIS installers impersonating legitimate applications, including Google Chrome, Microsoft Teams, and LetsVPN. Dragon Breath is associated with financially motivated attacks against the gaming and gambling sectors.
The loader decrypts and executes shellcode in memory, checks for administrative privileges, and requests elevation when necessary. It enumerates endpoint-security processes and deploys a signed kernel driver through temporary services to terminate antivirus processes. Additional defense-evasion mechanisms include user-mode hook removal, firewall manipulation, disabling User Account Control, phantom DLL side-loading, and thread-pool-based process injection. It installs an unsigned Windows Defender Application Control deny policy targeting Chinese security products and abuses Protected Process Light functionality to corrupt Microsoft Defender's executable, persistently disabling the product.
Later stages establish persistence through a Windows service and a watchdog script, then inject payloads into trusted Windows processes. The final modified Gh0st RAT provides remote command execution, additional payload delivery, host reconnaissance, keylogging, clipboard and active-window monitoring, and remotely configurable clipboard hijacking. These remote-access and surveillance functions belong to the delivered implant rather than the loader itself.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The report references Elastic Security Labs' November 2025 RONINGLOADER campaign, which used a LetsVPN decoy, ollama.sys, and a modified gh0st RAT payload.
Elastic Security Labs documented a RONINGLOADER / Dragon Breath campaign using a LetsVPN-themed decoy, ollama.sys, and a modified gh0st RAT payload.
Elastic Security Labs documented a RONINGLOADER / Dragon Breath campaign using a LetsVPN-themed decoy, ollama.sys, and a modified gh0st RAT payload.
Elastic Security Labs detailed the adversary's use of a multi-stage loader codenamed RONINGLOADER to distribute a Gh0st RAT variant through NSIS installers masquerading as legitimate programs like Google Chrome and Microsoft Teams.
Through this report, we hope to raise awareness of new techniques this malware is starting to implement and to shine a light on a unique loader we are naming RoningLoader.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
System commands are executed through cmd.exe with ShellExecuteW; batch files disable UAC and alter firewall rules.
The malware creates temporary services named xererre1 and ollama to load its kernel driver.
The deployed DLL, 1.dll , is copied to C:\Windows\System32\Wow64\Wow64Log.dll to be side-loaded by any WOW64 processes, as Wow64Log.dll is a phantom DLL
The scripts modify EnableLUA, while the final implant uses registry keys for persistence, configuration, telemetry tags, logger control, and clipboard-hijacker configuration.
RONINGLOADER writes ollama.sys to a temporary directory, creates a temporary service to load it... The service is deleted after the termination request.
The malware injects shellcode into vssvc.exe and svchost.exe through Windows thread-pool tasks, and injects subsequent payloads into TrustedInstaller.exe or elevation_service.exe with VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
The malware then injects code into regsvr32.exe — a native Windows utility — using CreateRemoteThread and LoadLibrary (T1055.001), pushing execution into high-privilege processes like TrustedInstaller.exe to conceal its activity further.
It grants itself the high integrity SeDebugPrivilege token before injecting into vssvc.exe.
RONINGLOADER writes ollama.sys to a temporary directory, creates a temporary service to load it... The service is deleted after the termination request.
1.bat disables UAC by setting the EnableLUA registry value to 0.
RONINGLOADER writes ollama.sys to a temporary directory [and] creates a temporary service to load it.
letsvpn-3.12.3.exe is a LetsVPN-branded payload, and tsetup-x64.5.13.1.exe is described as a trojanized Telegram Desktop installer.
Trojanized NSIS installers masquerade as legitimate software such as Google Chrome and Microsoft Teams.
The malware injects shellcode into vssvc.exe and svchost.exe through Windows thread-pool tasks, and injects subsequent payloads into TrustedInstaller.exe or elevation_service.exe with VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
The malware then injects code into regsvr32.exe — a native Windows utility — using CreateRemoteThread and LoadLibrary (T1055.001), pushing execution into high-privilege processes like TrustedInstaller.exe to conceal its activity further.
It grants itself the high integrity SeDebugPrivilege token before injecting into vssvc.exe.
The deployed DLL, 1.dll , is copied to C:\Windows\System32\Wow64\Wow64Log.dll to be side-loaded by any WOW64 processes, as Wow64Log.dll is a phantom DLL
The scripts modify EnableLUA, while the final implant uses registry keys for persistence, configuration, telemetry tags, logger control, and clipboard-hijacker configuration.
The malware writes an unsigned WDAC policy into CiPolicies\Active that denies specified Qihoo 360 and Huorong executables.
Terminates EDR/AV via ZwTerminateProcess from kernel context.
fhq.bat creates firewall rules blocking inbound and outbound connections for Qihoo 360 processes and disables firewall notifications.
If not, it attempts to elevate its privileges ... BeaconData { ... uint8_t is_admin ... }
The malware scans running processes for security tools and enumerates processes to select targets for payload injection.
RONINGLOADER scans a hardcoded list of running processes associated with Microsoft Defender, Kingsoft, Tencent PC Manager, and Qihoo 360.
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.