Loading story…
Sophos reported that Operation Dragon Breath—also tracked as APT-Q-27 and Golden Eye Dog—is using an expanded DLL sideloading chain to infect Windows users through trojanized installers posing as Telegram, LetsVPN, and WhatsApp. Instead of the usual clean application plus malicious DLL pairing, the campaign inserts a second legitimate executable that is launched automatically and then abused to sideload the malicious loader, helping the activity evade detection while preserving the same final payload path. The lures were distributed through a malicious Telegram-themed website and likely through Telegram itself, with victims observed in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China, primarily among Chinese-speaking users tied to online gambling activity.
The malicious loader decrypts shellcode from files such as templateX.txt or template.txt, decompresses and loads a final payload DLL named ServerDll.dll, and executes a backdoor designed in part to steal cryptocurrency wallets, including checks for the MetaMask Chrome extension. Sophos said the malware stores configuration data in the Windows registry and supports commands for code execution, clipboard access, file download, and event log clearing, while infrastructure including nsjdhmdjs[.]com was linked to the operation. Researchers also identified debug-style payload samples on VirusTotal containing Gh0st RAT source code, indicating possible tooling overlap or code reuse in the actor’s malware development.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Sophos linked infrastructure including nsjdhmdjs[.]com to Dragon Breath and observed repeated swapping of second-stage clean executables and DLL names to evade detection while preserving the same payload chain. The researchers also found debug-style payload variants on VirusTotal containing gh0st RAT source code, suggesting tooling overlap or code reuse.
Sophos found that the malicious loader decrypted shellcode from templateX.txt or template.txt, loaded a final payload DLL named ServerDll.dll, and executed a backdoor with commands for execution, clipboard access, file download, and event log clearing. The malware also checked for the MetaMask Chrome extension, indicating a focus on cryptocurrency wallet theft.
Sophos reported a multi-stage DLL sideloading campaign linked to Operation Dragon Breath, also known as APT-Q-27 or Golden Eye Dog. The activity used fake installers such as Telegram, LetsVPN, and WhatsApp packages to target Chinese-speaking Windows users involved in online gambling across the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the threat group **Dragon Breath**—also tracked as **APT-Q-27** and **Golden Eye Dog**—ran a multi-stage Windows malware campaign against Chinese-speaking users tied to online gambling, using trojanized installers themed as **Telegram**, **LetsVPN**, and **WhatsApp**. Victims were lured through infrastructure including `telegramos[.]org`, and observed targeting spanned the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China. The attack used a novel **double-clean-app** DLL sideloading chain: a malicious installer dropped a first-stage package that later launched a second legitimate application, which then sideloaded a malicious DLL and decrypted the final payload. Sophos said the final malware acted as a backdoor geared toward **cryptowallet theft**, including checks for the **MetaMask** Chrome extension and clipboard manipulation, while attribution to Dragon Breath was supported by shared C2 infrastructure, the recurring `ServerDll.dll` naming pattern, and repeated use of renamed legitimate binaries from vendors including Shenzhen Thunder Networking Technologies, Baidu, HP, and KingdomTwoCrowns.
Jun 29, 2026
The Dragon Breath APT group has been observed deploying a sophisticated multi-stage loader known as RoningLoader to deliver a modified variant of Gh0st RAT, primarily targeting Chinese-speaking users. The campaign utilizes trojanized NSIS installers that impersonate legitimate software such as Google Chrome and Microsoft Teams, leveraging a variety of evasion techniques including the use of a legitimately signed kernel driver, custom Windows Defender Application Control (WDAC) policies, and Protected Process Light (PPL) abuse to disable Microsoft Defender and other endpoint security products. These techniques allow the attackers to bypass security controls and establish persistent remote access on compromised systems. Elastic Security Labs researchers have detailed how the infection chain involves multiple embedded installers, with one acting as a decoy and the other initiating the attack sequence. The loader attempts to remove userland hooks by reloading `ntdll.dll` and uses a DLL to extract and execute shellcode from an encrypted file disguised as a PNG image. Dragon Breath, also known as APT-Q-27 and Golden Eye, has a history of targeting the online gaming and gambling industries across East Asia, and this latest campaign demonstrates their continued evolution in defense evasion and malware delivery tactics.
Jul 12, 2026
Elastic Security Labs identified a live **DragonBreath** (`APT-Q-27`) campaign targeting primarily Chinese-speaking users with trojanized MSI and NSIS installers masquerading as Google Chrome, Microsoft Teams, and other software. The installers deploy **RoningLoader**, a multi-stage loader that elevates privileges, establishes persistence, weakens security controls, and injects a modified `gh0st RAT` into trusted Windows processes. RoningLoader uses a validly signed kernel driver to terminate processes, manipulates firewall settings, deploys an unsigned WDAC deny policy aimed at Chinese antivirus products, and uses phantom-DLL sideloading. It also abuses ClipUp Protected Process Light functionality to corrupt Microsoft Defender's `MsMpEng.exe`, demonstrating the security impact of PPL-based EDR countermeasures. The resulting RAT communicates over encrypted raw TCP with `qaqkongtiao[.]com`, inventories hosts and security products, executes commands and delivers payloads, and supports keystroke, clipboard, and active-window logging, including remotely configured clipboard hijacking. Elastic released hashes, behavioral detections, and YARA rules for detection.
Sep 9, 2026