MalwareUsed by 3 actors

dragoncore_k.sys

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

ZIRCONIUM

dragoncore_k.sys is a WHQL-signed kernel driver whose unauthenticated IOCTL 0x22201C permits arbitrary kernel-mode process termination, including PPL-protected security processes.

via ransom isac blogransom-isac.org

APT-Q-27

dragoncore_k.sys is a WHQL-signed kernel driver whose unauthenticated IOCTL 0x22201C permits arbitrary kernel-mode process termination, including PPL-protected security processes.

via ransom isac blogransom-isac.org

Dragon Breath APT

dragoncore_k.sys is a WHQL-signed kernel driver whose unauthenticated IOCTL 0x22201C permits arbitrary kernel-mode process termination, including PPL-protected security processes.

via ransom isac blogransom-isac.org

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.003Code Signing CertificatesEvidence1

Zhengzhou 403 obtained consecutive GlobalSign EV code-signing certificates, which were used to sign malicious drivers and trojanized installers across 2024–2025.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

Driver Deployment — Dropped and registered as a Windows service via CreateServiceA.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

The signed dragoncore_k.sys driver exposes an unauthenticated IOCTL (0x22201C) that passes an attacker-supplied PID to ZwTerminateProcess from Ring 0.

T1543.003Windows ServiceEvidence1

Driver Deployment — Dropped and registered as a Windows service via CreateServiceA.

Stealth

4 techniques

T1014RootkitEvidence1

Driver loaded at Ring 0 enabling invisible system state modification.

T1497Virtualization/Sandbox EvasionEvidence1

The driver contains rate-limiting controls, while jnsupx.exe includes debug environment detection and long-sleep anti-sandbox controls.

T1564.010Process Argument SpoofingEvidence1

In-Memory Command-Line Modification writes modified command-line string back into target process PEB memory.

T1622Debugger EvasionEvidence1

Global Kill Switch byte_14000712C — a single-byte global flag gating the entire routine; the driver can be deployed dormant and activated remotely.

Defense Impairment

2 techniques

T1553.002Code SigningEvidence1

The report describes malicious drivers and a trojanized Telegram installer signed under Zhengzhou 403 GlobalSign EV certificates.

T1685Disable or Modify ToolsEvidence2

Payload constructs buffer with target PID (e.g., MsMpEng.exe) and issues DeviceIoControl(0x22201C); the driver executes ZwTerminateProcess from Ring 0.

Discovery

4 techniques

T1057Process DiscoveryEvidence1

PsGetProcessImageFileName + sub_140003E7C — enumerates target process image names against an internal filter.

T1497Virtualization/Sandbox EvasionEvidence1

The driver contains rate-limiting controls, while jnsupx.exe includes debug environment detection and long-sleep anti-sandbox controls.

T1518.001Security Software DiscoveryEvidence1

Only EDR/AV targets proceed to subsequent stages.

T1622Debugger EvasionEvidence1

Global Kill Switch byte_14000712C — a single-byte global flag gating the entire routine; the driver can be deployed dormant and activated remotely.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ransom isac blogNews

Apr 29, 2026

Dragon in the Kernel - Part II | Ransom-ISAC Blog - Ransom-ISAC

A malicious Windows kernel driver used to terminate EDR/AV processes from kernel mode and alter PEB command-line data to mislead endpoint-security telemetry.

ransom isac blogNews

Apr 22, 2026

DragonBreath: Dragon in the Kernel | Ransom-ISAC Blog - Ransom-ISAC

Purpose-built malicious Windows kernel driver used to neutralize EDR/AV, bypass PPL protections, inspect processes, and modify running processes' in-memory command-line data to undermine telemetry. It is deployed by malicious droppers and abuses a valid-but-revoked EV code-signing certificate.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 3 actors

dragoncore_k.sys

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

ZIRCONIUM

dragoncore_k.sys is a WHQL-signed kernel driver whose unauthenticated IOCTL 0x22201C permits arbitrary kernel-mode process termination, including PPL-protected security processes.

via ransom isac blogransom-isac.org

APT-Q-27

dragoncore_k.sys is a WHQL-signed kernel driver whose unauthenticated IOCTL 0x22201C permits arbitrary kernel-mode process termination, including PPL-protected security processes.

via ransom isac blogransom-isac.org

Dragon Breath APT

dragoncore_k.sys is a WHQL-signed kernel driver whose unauthenticated IOCTL 0x22201C permits arbitrary kernel-mode process termination, including PPL-protected security processes.

via ransom isac blogransom-isac.org

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.003Code Signing CertificatesEvidence1

Zhengzhou 403 obtained consecutive GlobalSign EV code-signing certificates, which were used to sign malicious drivers and trojanized installers across 2024–2025.

Persistence

1 technique

T1543.003Windows ServiceEvidence1

Driver Deployment — Dropped and registered as a Windows service via CreateServiceA.

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence1

The signed dragoncore_k.sys driver exposes an unauthenticated IOCTL (0x22201C) that passes an attacker-supplied PID to ZwTerminateProcess from Ring 0.

T1543.003Windows ServiceEvidence1

Driver Deployment — Dropped and registered as a Windows service via CreateServiceA.

Stealth

4 techniques

T1014RootkitEvidence1

Driver loaded at Ring 0 enabling invisible system state modification.

T1497Virtualization/Sandbox EvasionEvidence1

The driver contains rate-limiting controls, while jnsupx.exe includes debug environment detection and long-sleep anti-sandbox controls.

T1564.010Process Argument SpoofingEvidence1

In-Memory Command-Line Modification writes modified command-line string back into target process PEB memory.

T1622Debugger EvasionEvidence1

Global Kill Switch byte_14000712C — a single-byte global flag gating the entire routine; the driver can be deployed dormant and activated remotely.

Defense Impairment

2 techniques

T1553.002Code SigningEvidence1

The report describes malicious drivers and a trojanized Telegram installer signed under Zhengzhou 403 GlobalSign EV certificates.

T1685Disable or Modify ToolsEvidence2

Payload constructs buffer with target PID (e.g., MsMpEng.exe) and issues DeviceIoControl(0x22201C); the driver executes ZwTerminateProcess from Ring 0.

Discovery

4 techniques

T1057Process DiscoveryEvidence1

PsGetProcessImageFileName + sub_140003E7C — enumerates target process image names against an internal filter.

T1497Virtualization/Sandbox EvasionEvidence1

The driver contains rate-limiting controls, while jnsupx.exe includes debug environment detection and long-sleep anti-sandbox controls.

T1518.001Security Software DiscoveryEvidence1

Only EDR/AV targets proceed to subsequent stages.

T1622Debugger EvasionEvidence1

Global Kill Switch byte_14000712C — a single-byte global flag gating the entire routine; the driver can be deployed dormant and activated remotely.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

ransom isac blogNews

Apr 29, 2026

Dragon in the Kernel - Part II | Ransom-ISAC Blog - Ransom-ISAC

A malicious Windows kernel driver used to terminate EDR/AV processes from kernel mode and alter PEB command-line data to mislead endpoint-security telemetry.

ransom isac blogNews

Apr 22, 2026

DragonBreath: Dragon in the Kernel | Ransom-ISAC Blog - Ransom-ISAC

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.