Loading story…
Elastic Security Labs identified a live DragonBreath (APT-Q-27) campaign targeting primarily Chinese-speaking users with trojanized MSI and NSIS installers masquerading as Google Chrome, Microsoft Teams, and other software. The installers deploy RoningLoader, a multi-stage loader that elevates privileges, establishes persistence, weakens security controls, and injects a modified gh0st RAT into trusted Windows processes.
RoningLoader uses a validly signed kernel driver to terminate processes, manipulates firewall settings, deploys an unsigned WDAC deny policy aimed at Chinese antivirus products, and uses phantom-DLL sideloading. It also abuses ClipUp Protected Process Light functionality to corrupt Microsoft Defender's MsMpEng.exe, demonstrating the security impact of PPL-based EDR countermeasures. The resulting RAT communicates over encrypted raw TCP with qaqkongtiao[.]com, inventories hosts and security products, executes commands and delivers payloads, and supports keystroke, clipboard, and active-window logging, including remotely configured clipboard hijacking. Elastic released hashes, behavioral detections, and YARA rules for detection.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs identified a live campaign attributed to DragonBreath (APT-Q-27) targeting primarily Chinese-speaking users with trojanized installers that deploy a modified gh0st RAT. The campaign uses the newly named RoningLoader to elevate privileges, impair security tools, persist, and inject payloads into trusted Windows processes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcezerosalarium.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Dragon Breath APT group has been observed deploying a sophisticated multi-stage loader known as RoningLoader to deliver a modified variant of Gh0st RAT, primarily targeting Chinese-speaking users. The campaign utilizes trojanized NSIS installers that impersonate legitimate software such as Google Chrome and Microsoft Teams, leveraging a variety of evasion techniques including the use of a legitimately signed kernel driver, custom Windows Defender Application Control (WDAC) policies, and Protected Process Light (PPL) abuse to disable Microsoft Defender and other endpoint security products. These techniques allow the attackers to bypass security controls and establish persistent remote access on compromised systems. Elastic Security Labs researchers have detailed how the infection chain involves multiple embedded installers, with one acting as a decoy and the other initiating the attack sequence. The loader attempts to remove userland hooks by reloading `ntdll.dll` and uses a DLL to extract and execute shellcode from an encrypted file disguised as a PNG image. Dragon Breath, also known as APT-Q-27 and Golden Eye, has a history of targeting the online gaming and gambling industries across East Asia, and this latest campaign demonstrates their continued evolution in defense evasion and malware delivery tactics.
Jul 12, 2026
Sophos reported that **Operation Dragon Breath**—also tracked as **APT-Q-27** and **Golden Eye Dog**—is using an expanded DLL sideloading chain to infect Windows users through trojanized installers posing as **Telegram**, **LetsVPN**, and **WhatsApp**. Instead of the usual clean application plus malicious DLL pairing, the campaign inserts a second legitimate executable that is launched automatically and then abused to sideload the malicious loader, helping the activity evade detection while preserving the same final payload path. The lures were distributed through a malicious Telegram-themed website and likely through Telegram itself, with victims observed in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China, primarily among Chinese-speaking users tied to online gambling activity. The malicious loader decrypts shellcode from files such as `templateX.txt` or `template.txt`, decompresses and loads a final payload DLL named `ServerDll.dll`, and executes a backdoor designed in part to steal cryptocurrency wallets, including checks for the **MetaMask** Chrome extension. Sophos said the malware stores configuration data in the Windows registry and supports commands for code execution, clipboard access, file download, and event log clearing, while infrastructure including `nsjdhmdjs[.]com` was linked to the operation. Researchers also identified debug-style payload samples on VirusTotal containing **Gh0st RAT** source code, indicating possible tooling overlap or code reuse in the actor’s malware development.
Jun 29, 2026
Sophos reported that the threat group **Dragon Breath**—also tracked as **APT-Q-27** and **Golden Eye Dog**—ran a multi-stage Windows malware campaign against Chinese-speaking users tied to online gambling, using trojanized installers themed as **Telegram**, **LetsVPN**, and **WhatsApp**. Victims were lured through infrastructure including `telegramos[.]org`, and observed targeting spanned the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China. The attack used a novel **double-clean-app** DLL sideloading chain: a malicious installer dropped a first-stage package that later launched a second legitimate application, which then sideloaded a malicious DLL and decrypted the final payload. Sophos said the final malware acted as a backdoor geared toward **cryptowallet theft**, including checks for the **MetaMask** Chrome extension and clipboard manipulation, while attribution to Dragon Breath was supported by shared C2 infrastructure, the recurring `ServerDll.dll` naming pattern, and repeated use of renamed legitimate binaries from vendors including Shenzhen Thunder Networking Technologies, Baidu, HP, and KingdomTwoCrowns.
Jun 29, 2026