DragonBreath
DragonBreath, also tracked as APT-Q-27, is a Chinese-nexus threat actor active since at least 2020. The actor has been linked to attacks on the online gaming and gambling industries and has targeted organizations and users in China, Taiwan, Hong Kong, Japan, Singapore, and the Philippines, including overseas Chinese individuals and Chinese-speaking users. Recent reporting associates DragonBreath with a stealthy malware campaign using the multi-stage RoningLoader (also styled RONINGLOADER), which has been documented deploying an updated Gh0st RAT variant. The infection chain uses trojanized NSIS installers masquerading as trusted software such as Google Chrome and Microsoft Teams. These installers drop a legitimate application alongside hidden malicious components to reduce suspicion. RoningLoader uses DLL side-loading, in-memory shellcode execution, code injection into regsvr32.exe, thread-pool injection, and execution in higher-privilege processes such as TrustedInstaller.exe. Reported evasion and defense-impairment behavior includes enabling SeDebugPrivilege, disabling User Account Control via registry changes, abusing Protected Process Light (PPL) to disable Microsoft Defender, using phantom DLLs, and leveraging a legitimately signed kernel driver to terminate security products and evade Chinese EDR tools. Reported targeted security products include Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, Qihoo 360 Total Security, 360 Total Security, and Huorong. The final payload is a modified Gh0st RAT that provides full remote access and has been associated with data theft, lateral movement, and long-term espionage.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Consumer Services
Where they target
Geographies tied to known operations.
- 🇨🇳 China
- 🇹🇼 Taiwan
- 🇭🇰 Hong Kong SAR China
- 🇯🇵 Japan
- 🇸🇬 Singapore
- 🇵🇭 Philippines
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a stealthy malware campaign using RoningLoader to target Chinese-speaking users, disable security tools, deploy a modified gh0st RAT, and enable data theft, lateral movement, and long-term espionage.
DragonBreath is referenced in connection with RONINGLOADER and a technique described as a new path to PPL abuse.
Threat actor associated with a campaign using advanced Windows defense-evasion to disable/impair endpoint security tooling, including abusing Protected Process Light and a signed kernel driver to terminate security processes.
Associated with a campaign using a multi-stage loader (RONINGLOADER) to deploy an updated gh0st RAT variant, leveraging signed drivers, thread-pool injection, and PPL abuse to disable Microsoft Defender and evade Chinese EDR tools.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.