DragonBreath RoningLoader Abuses Protected Processes to Disable Windows Defenses

Elastic Security Labs identified a live DragonBreath (APT-Q-27) campaign targeting primarily Chinese-speaking users with trojanized MSI and NSIS installers masquerading as Google Chrome, Microsoft Teams, and other software. The installers deploy RoningLoader, a multi-stage loader that elevates privileges, establishes persistence, weakens security controls, and injects a modified gh0st RAT into trusted Windows processes.

RoningLoader uses a validly signed kernel driver to terminate processes, manipulates firewall settings, deploys an unsigned WDAC deny policy aimed at Chinese antivirus products, and uses phantom-DLL sideloading. It also abuses ClipUp Protected Process Light functionality to corrupt Microsoft Defender's MsMpEng.exe, demonstrating the security impact of PPL-based EDR countermeasures. The resulting RAT communicates over encrypted raw TCP with qaqkongtiao[.]com, inventories hosts and security products, executes commands and delivers payloads, and supports keystroke, clipboard, and active-window logging, including remotely configured clipboard hijacking. Elastic released hashes, behavioral detections, and YARA rules for detection.