Dragon Breath

Dragon Breath, also tracked as APT-Q-27 and Golden Eye Dog, is a financially motivated threat actor. Elastic Security Labs described it as targeting the gambling sector using SERP poisoning, social engineering, and DDoS attacks. More recent reporting attributed to Dragon Breath documents malware delivery through trojanized MSI and NSIS installers masquerading as legitimate software such as Google Chrome and Microsoft Teams, with campaigns primarily targeting Chinese-speaking users. In the reported 2025 activity, Dragon Breath used a custom multi-stage loader named RoningLoader to deliver a modified gh0st RAT. The intrusion chain included multiple defense-evasion and anti-security techniques: loading a fresh copy of ntdll.dll and resolving APIs dynamically to reduce userland hook visibility; privilege escalation via runas; use of a legitimately signed kernel driver, ollama.sys, to terminate security processes; abuse of Protected Process Light through ClipUp.exe to corrupt Microsoft Defender’s MsMpEng.exe; phantom DLL side-loading via Wow64Log.dll; thread-pool-based remote execution; and deployment of an unsigned WDAC policy to block Chinese antivirus products including Qihoo 360 and Huorong. The malware also modified firewall settings, disabled UAC, created services, and used watchdog batch scripts for persistence. The final payload was reported as a modified version of the open-source gh0st RAT, linked by Elastic to prior Dragon Breath reporting by Sophos and QianXin. Reported capabilities included encrypted raw TCP C2 communications, beaconing, command execution, file download and execution, event log clearing, process injection, keylogging, clipboard logging and hijacking, active-window logging, and collection of host, OS, CPU, privilege, uptime, antivirus, Telegram, and clipboard-related metadata. Known aliases and associated names directly mentioned in the content include APT-Q-27 and Golden Eye Dog.