Loading threat actor…
Operation Dragon Breath is a cyber threat actor also tracked as APT-Q-27 and Golden Eye Dog. The actor is associated with campaigns targeting Chinese-speaking Windows users involved in the online-gambling ecosystem and related participants. Observed victim geography includes the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China. The group is notable for multi-stage DLL sideloading tradecraft that evolves the classic clean-application-plus-malicious-DLL pattern by inserting an additional legitimate application stage. Campaigns have used trojanized installers themed as popular software to gain initial access, after which the malware deploys staged components, establishes persistence through startup shortcuts, and delays parts of the infection chain in a manner consistent with anti-analysis and defense-evasion objectives. Across variants, the actor repeatedly swaps signed or legitimate executables and corresponding sideloaded DLL dependencies while preserving the same downstream payload chain. The loader decrypts and executes shellcode that decompresses and reflectively loads a final backdoor payload into memory. That payload supports command execution, file download and execution, clipboard access and manipulation, configuration storage in the registry, and clearing event logs. The tooling shows a strong focus on cryptocurrency theft, including checks associated with MetaMask and clipboard-related functionality consistent with wallet theft workflows. Debug-style payload variants have also shown gh0st RAT source-code overlap, suggesting code reuse or development lineage within the actor’s tooling. Operation Dragon Breath is best characterized as a financially motivated intrusion set specializing in online-gambling-related targeting, using DLL sideloading, persistence, defense evasion, post-exploitation backdoor functionality, and cryptowallet theft.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
17 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting multi-stage DLL sideloading campaigns targeting Chinese-speaking users involved in online gambling, using trojanized installers delivered via Telegram-themed lures and ultimately deploying payloads for cryptowallet theft, including targeting MetaMask users.
Conducting DLL sideloading campaigns with multi-stage loaders targeting online-gambling participants, ultimately focused on cryptowallet theft including MetaMask-related theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.