Loading threat actor…
DragonBreath, also tracked as APT-Q-27 and Golden Eye Dog, is a financially motivated threat actor active since at least 2020. The group is associated with campaigns targeting the online gaming and gambling ecosystem and Chinese-speaking users across East and Southeast Asia. Reported victim geography includes China, Taiwan, Hong Kong, Japan, Singapore, and the Philippines. DragonBreath is known for social-engineering and search-engine poisoning driven delivery, including trojanized installers masquerading as legitimate software. A prominent campaign used the multi-stage RoningLoader framework to deploy an updated variant of Gh0st RAT. This intrusion chain relied on DLL sideloading, in-memory shellcode execution, process injection, service-based persistence, privilege elevation, and multiple redundant defense-evasion layers designed to disable or bypass endpoint protections. Observed tradecraft includes abuse of a legitimately signed kernel driver to terminate security processes, Protected Process Light abuse to disrupt Microsoft Defender, phantom DLL sideloading, unsigned WDAC policy abuse to block selected Chinese security products, firewall manipulation, UAC disabling, and watchdog mechanisms to maintain persistence. The final Gh0st RAT variant supports remote command execution, file transfer and execution, host reconnaissance, keylogging, clipboard theft and hijacking, active-window logging, and additional process injection. Reporting has also linked DragonBreath to DDoS activity in support of operations against the gambling sector. DragonBreath demonstrates a mature post-compromise toolkit focused on stealth, persistence, and monetizable access, with repeated emphasis on defeating Chinese endpoint security products and maintaining long-term control over victim systems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
34 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a threat actor known for using DLL sideloading, specifically a double-sideloading attack.
Conducting a stealthy malware campaign using RoningLoader to target Chinese-speaking users, disable security tools, deploy a modified gh0st RAT, and enable data theft, lateral movement, and long-term espionage.
Actor targeting primarily Chinese-speaking users using trojanized installers and a multi-stage loader (RONINGLOADER) to deploy a modified Gh0st RAT.
DragonBreath is referenced in connection with RONINGLOADER and a technique described as a new path to PPL abuse.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.