Loading story…
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including Google Chrome, Microsoft Teams, Surfshark, Signal, Telegram, Zoom, DeepSeek, Quark Cloud, and activation tools. The attacks rely on spoofed download sites and malicious MSI or NSIS packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the Gh0st RAT ecosystem, including modified Gh0st variants and Atlas RAT. Researchers linked the activity to Chinese-speaking threat actors including Dragon Breath and Silver Fox, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates.
The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned WDAC policies to block Chinese antivirus tools, Protected Process Light abuse to corrupt Microsoft Defender's MsMpEng.exe, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Ransom-ISAC published a report titled "DragonBreath: Dragon in the Kernel." The provided content includes no further event details from the report itself.
Hexastrike disclosed technical details of the Silver Fox campaign, including its Setup Factory installer chain, trojanized Autodesk loader, Gh0st RAT-style configuration, and in-memory Atlas RAT execution. The report also described PowerChell-based PowerShell abuse and disruption of Chinese security products.
Hexastrike assessed the Silver Fox malware campaign as ongoing from at least November 2025 through March 2026. The operation used typosquatted software-download sites and EV-signed trojanized installers to deliver Atlas RAT to Chinese-speaking users.
A cluster of malicious delivery domains used in the Silver Fox campaign was registered on October 27, 2025, indicating batch provisioning at the start of the operation. The domains impersonated brands such as Zoom, Signal, Surfshark, Telegram, and Microsoft Teams.
An Intrusion Truth post titled "Trouble in Paradise" documented developments related to Chinese influence-operation actors. The provided content does not include event details beyond the publication itself.
Zscaler ThreatLabz identified a Chinese-speaking cybercrime campaign using fake DeepSeek, Quark Cloud, and Pony Activator pages to deliver a malicious WiX-built MSI installer. The malware decrypted payloads in memory, abused the vulnerable Adlice TrueSight 2.0.2 driver to kill more than 200 security products, and then deployed a Gh0st RAT variant.
Elastic Security Labs reported a Dragon Breath campaign using trojanized MSI and NSIS installers masquerading as software such as Google Chrome and Microsoft Teams. The infection chain delivered a modified gh0st RAT and used RoningLoader, a signed kernel driver, and PPL abuse to disable security tools.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceransom-isac.com
Open sourcehexastrike.com
Open sourceelastic.co
Open sourceintrusiontruth.wordpress.com
Open sourcehunt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered two major global malware campaigns that deliver the Gh0st RAT remote access trojan through large-scale software impersonation tactics. Attackers use trojanized installers mimicking legitimate applications such as Microsoft Teams and Google Chrome to distribute the RONINGLOADER loader, which in turn deploys an updated version of Gh0st RAT. The campaigns primarily target Chinese-speaking users and employ advanced evasion techniques, including DLL injection, removal of userland hooks, and anti-virus termination, to maintain persistence and avoid detection. The updated Gh0st RAT malware enables attackers to execute commands, manipulate Windows Registry keys, capture clipboard data, inject shell code, and log keystrokes and window titles. These campaigns highlight the increasing sophistication of threat actors in leveraging multi-stage loaders and social engineering to compromise victims at scale. The findings are supported by analyses from both Palo Alto Networks Unit 42 and Elastic Security Labs, emphasizing the need for heightened vigilance against software impersonation and loader-based malware delivery.
Jun 29, 2026
The Dragon Breath APT group has been observed deploying a sophisticated multi-stage loader known as RoningLoader to deliver a modified variant of Gh0st RAT, primarily targeting Chinese-speaking users. The campaign utilizes trojanized NSIS installers that impersonate legitimate software such as Google Chrome and Microsoft Teams, leveraging a variety of evasion techniques including the use of a legitimately signed kernel driver, custom Windows Defender Application Control (WDAC) policies, and Protected Process Light (PPL) abuse to disable Microsoft Defender and other endpoint security products. These techniques allow the attackers to bypass security controls and establish persistent remote access on compromised systems. Elastic Security Labs researchers have detailed how the infection chain involves multiple embedded installers, with one acting as a decoy and the other initiating the attack sequence. The loader attempts to remove userland hooks by reloading `ntdll.dll` and uses a DLL to extract and execute shellcode from an encrypted file disguised as a PNG image. Dragon Breath, also known as APT-Q-27 and Golden Eye, has a history of targeting the online gaming and gambling industries across East Asia, and this latest campaign demonstrates their continued evolution in defense evasion and malware delivery tactics.
Jul 12, 2026
A malware campaign is using fake Microsoft Teams download pages promoted on **X** to lure corporate users into installing trojanized ZIP archives that deploy **ValleyRAT**. Researchers said the infection chain relies on an **NSIS** installer and **DLL sideloading** through Tencent’s legitimate `GameBox.exe`, then uses PowerShell to add Windows Defender exclusions, hide files, and establish persistence through unauthorized service creation and registry artifacts including `_CCGDAT`. Once executed, the loader decrypts staged payloads from `user.dat` in memory using **AES** and **XOR**, with additional evasion through API hashing and reflective loading. The final ValleyRAT payload captures keystrokes, clipboard contents, and active-window activity before exfiltrating data to command-and-control infrastructure at `103.215.77.17`; researchers said the campaign shows Chinese-language artifacts and behavioral overlaps that likely tie it to the **SilverFox APT** cluster.
Jun 30, 2026