Operation Dragon Breath
Operation Dragon Breath, also referred to as APT-Q-27 and Golden Eye Dog, is a threat actor associated by Sophos with multi-stage DLL sideloading campaigns targeting Chinese-speaking Windows users involved in the online-gambling ecosystem. Observed targeting included users in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China. The actor is described as specializing in the online-gambling space and its participants. The documented campaigns used trojanized installers and fake software delivery, including Telegram, LetsVPN, and WhatsApp-themed packages, with infrastructure such as telegramos[.]org impersonating Telegram downloads. A characteristic tradecraft element is a modified DLL sideloading chain that adds an extra clean-application stage: an initial trojanized installer drops a first-stage package, which launches a second legitimate application that sideloads a malicious DLL loader and decrypts the final payload. Observed second-stage variations used renamed legitimate binaries from Shenzhen Thunder Networking Technologies, Beijing Baidu Netcom Science and Technology Co., Ltd., HP Inc., and KingdomTwoCrowns, while preserving the same payload chain. The malicious loader decrypted shellcode from templateX.txt or template.txt using a bytewise SUB 122 and XOR 0x19 routine, then used RtlDecompressBuffer to load a final payload DLL named ServerDll.dll into memory. The payload established registry-based configuration under HKCU\SOFTWARE%COMPUTERNAME% or HKCU\SOFTWARE\UnkNow and supported commands including shutdown or logoff, clearing event logs, downloading and executing files, running commands visibly or hidden, and reading or setting clipboard contents. The payload also checked for the MetaMask Chrome extension ID nkbihfbeogaeaoehlefnkodbefgpgknn, indicating a focus on cryptowallet theft; Sophos assessed that the observed attack paths ultimately led to cryptowallet theft. Sophos linked the activity to Operation Dragon Breath through shared C2 infrastructure, including nsjdhmdjs[.]com, use of the ServerDll.dll naming convention, and characteristic sideloading tradecraft. Sophos also identified related debug-style payload samples containing gh0st RAT source code, suggesting tooling overlap or code reuse within the actor’s malware development.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇵🇭 Philippines
- 🇯🇵 Japan
- 🇹🇼 Taiwan
- 🇸🇬 Singapore
- 🇭🇰 Hong Kong SAR China
- 🇨🇳 China
Tradecraft
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
17 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting multi-stage DLL sideloading campaigns targeting Chinese-speaking users involved in online gambling, using trojanized installers delivered via Telegram-themed lures and ultimately deploying payloads for cryptowallet theft, including targeting MetaMask users.
Conducting DLL sideloading campaigns with multi-stage loaders targeting online-gambling participants, ultimately focused on cryptowallet theft including MetaMask-related theft.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.