RoningLoader
RONINGLOADER is a multi-stage Windows malware loader identified by Elastic Security Labs in 2025 and used by the DragonBreath threat actor, also tracked as APT-Q-27 and Golden Eye Dog. It has been used in campaigns primarily targeting Chinese-speaking users and the gambling sector, with trojanized MSI and NSIS installers masquerading as legitimate software such as Google Chrome and Microsoft Teams. The infection chain drops a benign installer alongside malicious components, including a DLL and an encrypted file disguised as a PNG, then decrypts shellcode and executes later stages in memory.
The loader is designed with multiple defense-evasion and security-disruption layers. Reported behaviors include loading a fresh copy of ntdll.dll to avoid userland hooks, checking for administrative privileges and relaunching elevated via runas, enumerating security processes, disabling UAC, modifying firewall settings, creating services, and staging additional payloads under ProgramData and other directories. It abuses Protected Process Light (PPL) via ClipUp.exe to disable Microsoft Defender by corrupting MsMpEng.exe, uses phantom DLL side-loading, thread-pool-based process injection, and writes an unsigned WDAC policy that blocks Chinese security products including Qihoo 360 and Huorong. It also uses a legitimately signed kernel driver, ollama.sys, to terminate security processes associated with Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, and Qihoo 360.
RONINGLOADER establishes persistence through service creation and watchdog batch scripts, including execution of goldendays.dll via regsvr32.exe and subsequent injection into high-privilege processes such as TrustedInstaller.exe or MicrosoftEdgeElevationService. Later stages inject additional payloads using NtCreateSection, NtMapViewOfSection, CreateRemoteThread, VirtualAllocEx, and WriteProcessMemory.
The final payload delivered by RONINGLOADER is a modified version of the open-source gh0st RAT associated with DragonBreath. Reported capabilities of that payload include encrypted raw TCP command-and-control, beaconing, shell command execution, file download and execution, event log clearing, custom shellcode injection, keylogging, clipboard logging and hijacking, active-window logging, and process injection. High-confidence indicators mentioned in the content include the mutex Global\DHGGlobalMutex, logging to %ProgramData%\microsoft.dotnet.common.log, storage of clipboard hijacker settings under HKEY_CURRENT_USER\offlinekey, and a reported stage-4 C2 domain of qaqkongtiao[.]com. Elastic published YARA detections including Windows.Trojan.RoningLoader for this malware.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Through this report, we hope to raise awareness of new techniques this malware is starting to implement and to shine a light on a unique loader we are naming RoningLoader.
Through this report, we hope to raise awareness of new techniques this malware is starting to implement and to shine a light on a unique loader we are naming RoningLoader.
A threat actor known as DragonBreath has launched a stealthy campaign using a multi-stage malware loader called RoningLoader.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
3 techniques
Execution
Note that all of the system commands executed are through cmd.exe with the ShellExecuteW API
Persistence
2 techniques
Persistence
1.bat is a simple batch script that disables User Account Control (UAC) by setting the EnableLUA registry value to 0 ... Set registry key Enable to False to terminate & disable implant persistently ... Configuration parameters are stored in the registry under HKEY_CURRENT_USER\offlinekey
Privilege Escalation
5 techniques
Privilege Escalation
it calls a function to inject shellcode into the process ( vssvc.exe ) ... This technique leverages the thread pool to remotely execute code ... it injects another shellcode into svchost.exe ... writes to it with WriteProcessMemory , and then creates a remote thread to execute it with CreateRemoteThread
The malware then injects code into regsvr32.exe — a native Windows utility — using CreateRemoteThread and LoadLibrary (T1055.001), pushing execution into high-privilege processes like TrustedInstaller.exe to conceal its activity further.
It first grants itself the high integrity SeDebugPrivilege token.
Stealth
5 techniques
Stealth
the malicious installers being distributed under various themes, masquerading as legitimate software such as Google Chrome, Microsoft Teams, or other trusted applications to lure users into executing them
it calls a function to inject shellcode into the process ( vssvc.exe ) ... This technique leverages the thread pool to remotely execute code ... it injects another shellcode into svchost.exe ... writes to it with WriteProcessMemory , and then creates a remote thread to execute it with CreateRemoteThread
The malware then injects code into regsvr32.exe — a native Windows utility — using CreateRemoteThread and LoadLibrary (T1055.001), pushing execution into high-privilege processes like TrustedInstaller.exe to conceal its activity further.
Defense Impairment
2 techniques
Defense Impairment
1.bat is a simple batch script that disables User Account Control (UAC) by setting the EnableLUA registry value to 0 ... Set registry key Enable to False to terminate & disable implant persistently ... Configuration parameters are stored in the registry under HKEY_CURRENT_USER\offlinekey
The malware directly targets Windows Defender Application Control (WDAC) by writing a policy file to the path C:\\Windows\\System32\\CodeIntegrity\\CiPolicies\\Active\\{31351756-3F24-4963-8380-4E7602335AAE}.cip ... Enabled:Unsigned System Integrity Policy rule, which allows the policy to be loaded without a valid digital signature.
Discovery
3 techniques
Discovery
If not, it attempts to elevate its privileges ... BeaconData { ... uint8_t is_admin ... }
Other
2 techniques
Other
The malware employs an abuse of Protected Process Light (PPL) to disable Windows Defender ... threat actors leverage a valid, signed kernel driver to kill processes ... Custom unsigned WDAC policy applied to block 360 Total Security and Huorong executables
First, it blocks all network communication by changing the firewall ... fhq.bat is another batch script that targets ... 360Safe.exe by creating firewall rules that block inbound and outbound connections to them. It also disables firewall notifications across all profiles.
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-stage malware loader delivered via trojanized NSIS installers. It uses DLL side-loading, in-memory shellcode execution, code injection, privilege escalation, UAC disabling, and a signed kernel driver to disable security tools before deploying a final payload.
Multi-stage loader used to disable security tools and deliver a modified Gh0st RAT payload.
A loader associated with the DragonBreath actor, discussed in the context of abusing PPL (Protected Process Light) mechanisms.
RONINGLOADER is a multi-stage loader used to deliver additional malware payloads, associated with financially motivated attacks against the gambling sector.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.