Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT
Summary: Elastic Security Labs reported that the threat actor Dragon Breath, also tracked as APT-Q-27 and Golden Eye and active since at least 2020, used a multi-stage loader called RONINGLOADER to deliver a modified Gh0st RAT through trojanized NSIS installers posing as Google Chrome and Microsoft Teams. The loader scans for and terminates antivirus processes including Microsoft Defender Antivirus, Kingsoft Internet Security, Tencent PC Manager and Qihoo 360 Total Security, brings a legitimately signed driver, deploys custom WDAC policies, and abuses PPL and Windows Error Reporting to disable Defender before injecting a rogue DLL into regsvr32.exe.
Bottom line: The loader is built to kill the endpoint security products common in the Chinese market, then writes a WDAC policy that explicitly blocks Qihoo 360 and Huorong Security - so on an infected host your own defenses are turned against each other before the RAT ever runs.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026