Loading story…
The Dragon Breath APT group has been observed deploying a sophisticated multi-stage loader known as RoningLoader to deliver a modified variant of Gh0st RAT, primarily targeting Chinese-speaking users. The campaign utilizes trojanized NSIS installers that impersonate legitimate software such as Google Chrome and Microsoft Teams, leveraging a variety of evasion techniques including the use of a legitimately signed kernel driver, custom Windows Defender Application Control (WDAC) policies, and Protected Process Light (PPL) abuse to disable Microsoft Defender and other endpoint security products. These techniques allow the attackers to bypass security controls and establish persistent remote access on compromised systems.
Elastic Security Labs researchers have detailed how the infection chain involves multiple embedded installers, with one acting as a decoy and the other initiating the attack sequence. The loader attempts to remove userland hooks by reloading ntdll.dll and uses a DLL to extract and execute shellcode from an encrypted file disguised as a PNG image. Dragon Breath, also known as APT-Q-27 and Golden Eye, has a history of targeting the online gaming and gambling industries across East Asia, and this latest campaign demonstrates their continued evolution in defense evasion and malware delivery tactics.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Security reporting described a Dragon Breath intrusion set using the RONINGLOADER malware loader to disable Windows security tools, including Windows Defender, through kernel-driver and Protected Process Light abuse. The campaign was also reported as delivering Gh0st RAT on compromised systems.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs identified a live **DragonBreath** (`APT-Q-27`) campaign targeting primarily Chinese-speaking users with trojanized MSI and NSIS installers masquerading as Google Chrome, Microsoft Teams, and other software. The installers deploy **RoningLoader**, a multi-stage loader that elevates privileges, establishes persistence, weakens security controls, and injects a modified `gh0st RAT` into trusted Windows processes. RoningLoader uses a validly signed kernel driver to terminate processes, manipulates firewall settings, deploys an unsigned WDAC deny policy aimed at Chinese antivirus products, and uses phantom-DLL sideloading. It also abuses ClipUp Protected Process Light functionality to corrupt Microsoft Defender's `MsMpEng.exe`, demonstrating the security impact of PPL-based EDR countermeasures. The resulting RAT communicates over encrypted raw TCP with `qaqkongtiao[.]com`, inventories hosts and security products, executes commands and delivers payloads, and supports keystroke, clipboard, and active-window logging, including remotely configured clipboard hijacking. Elastic released hashes, behavioral detections, and YARA rules for detection.
Sep 9, 2026
Sophos reported that **Operation Dragon Breath**—also tracked as **APT-Q-27** and **Golden Eye Dog**—is using an expanded DLL sideloading chain to infect Windows users through trojanized installers posing as **Telegram**, **LetsVPN**, and **WhatsApp**. Instead of the usual clean application plus malicious DLL pairing, the campaign inserts a second legitimate executable that is launched automatically and then abused to sideload the malicious loader, helping the activity evade detection while preserving the same final payload path. The lures were distributed through a malicious Telegram-themed website and likely through Telegram itself, with victims observed in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China, primarily among Chinese-speaking users tied to online gambling activity. The malicious loader decrypts shellcode from files such as `templateX.txt` or `template.txt`, decompresses and loads a final payload DLL named `ServerDll.dll`, and executes a backdoor designed in part to steal cryptocurrency wallets, including checks for the **MetaMask** Chrome extension. Sophos said the malware stores configuration data in the Windows registry and supports commands for code execution, clipboard access, file download, and event log clearing, while infrastructure including `nsjdhmdjs[.]com` was linked to the operation. Researchers also identified debug-style payload samples on VirusTotal containing **Gh0st RAT** source code, indicating possible tooling overlap or code reuse in the actor’s malware development.
Jun 29, 2026
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Aug 14, 2026