Dragon Breath Expands DLL Sideloading to Deliver Wallet-Theft Backdoor

Sophos reported that Operation Dragon Breath—also tracked as APT-Q-27 and Golden Eye Dog—is using an expanded DLL sideloading chain to infect Windows users through trojanized installers posing as Telegram, LetsVPN, and WhatsApp. Instead of the usual clean application plus malicious DLL pairing, the campaign inserts a second legitimate executable that is launched automatically and then abused to sideload the malicious loader, helping the activity evade detection while preserving the same final payload path. The lures were distributed through a malicious Telegram-themed website and likely through Telegram itself, with victims observed in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China, primarily among Chinese-speaking users tied to online gambling activity.

The malicious loader decrypts shellcode from files such as templateX.txt or template.txt, decompresses and loads a final payload DLL named ServerDll.dll, and executes a backdoor designed in part to steal cryptocurrency wallets, including checks for the MetaMask Chrome extension. Sophos said the malware stores configuration data in the Windows registry and supports commands for code execution, clipboard access, file download, and event log clearing, while infrastructure including nsjdhmdjs[.]com was linked to the operation. Researchers also identified debug-style payload samples on VirusTotal containing Gh0st RAT source code, indicating possible tooling overlap or code reuse in the actor’s malware development.