Dragon Breath (APT-Q-27) Deploys RONINGLOADER to Disable Security Tools and Drop Gh0st RAT

Key facts

Detection coverage

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1996 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ollama.sys Signed-Driver AV/EDR Kill + Unsigned WDAC Policy Drop + ClipUp PPL Defender Tampering

Detects the RONINGLOADER security-tool-blinding stage: load of the validly-signed but abused ollama.sys kernel driver (which exposes IOCTL 0x222000 for privileged ZwOpenProcess/ZwTerminateProcess against Chinese AV/EDR processes), deployment of the unsigned WDAC Code Integrity policy into CiPolicies\Active, and ClipUp.exe -ppl invoked against a fake Defender path to overwrite MsMpEng.exe (EDR-Freeze/PPL abuse). Also covers regsvr32 proxy execution of goldendays.dll and creation of the MicrosoftSoftware2ShadowCop4yProvider persistence service.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1562.001, T1553.006, T1553.002, T1218.010, T1055, T1543.003, T1548.002, T1518.001
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=6 OR EventCode=11 OR EventCode=1 OR EventCode=7))
| eval cl=lower(CommandLine), img=lower(Image), tgt=lower(TargetFilename)
| where (EventCode=6 AND (ImageLoaded LIKE "%ollama.sys" OR Hashes LIKE "%2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5%"))
   OR (EventCode=11 AND tgt LIKE "%\\windows\\system32\\codeintegrity\\cipolicies\\active\\%.cip")
   OR (EventCode=1 AND img LIKE "%\\clipup.exe" AND cl LIKE "%-ppl%" AND cl LIKE "%msmpeng.exe%")
   OR (EventCode=1 AND img LIKE "%\\regsvr32.exe" AND cl LIKE "%goldendays.dll%")
| stats count min(_time) as first_seen values(CommandLine) as cmd values(TargetFilename) as target values(ImageLoaded) as driver by ComputerName, User, EventCode, Image
| where count > 0

``` companion query: service creation ```
 index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
| search ServiceName="MicrosoftSoftware2ShadowCop4yProvider"
| table _time, ComputerName, ServiceName, ServiceFileName, StartType

Microsoft KQL

let driver_load = DeviceEvents
| where Timestamp > ago(24h) and ActionType == "DriverLoad"
| where FileName =~ "ollama.sys" or SHA256 == "2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5";
let wdac_drop = DeviceFileEvents
| where Timestamp > ago(24h) and FolderPath has @"\Windows\System32\CodeIntegrity\CiPolicies\Active\" and FileName endswith ".cip";
let ppl_abuse = DeviceProcessEvents
| where Timestamp > ago(24h) and FileName =~ "ClipUp.exe" and ProcessCommandLine has "-ppl" and ProcessCommandLine has "MsMpEng.exe";
let regsvr32_proxy = DeviceProcessEvents
| where Timestamp > ago(24h) and FileName =~ "regsvr32.exe" and ProcessCommandLine has "goldendays.dll";
driver_load | union wdac_drop | union ppl_abuse | union regsvr32_proxy
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: RONINGLOADER Security-Tool Blinding via ollama.sys, Unsigned WDAC Policy, and ClipUp PPL Abuse
id: 9c2e4a71-8b1d-4f0c-a3e5-1d6f7c9b2a44
status: experimental
description: Detects RONINGLOADER's AV/EDR-blinding stage -- signed kernel driver ollama.sys loading with a known privileged-termination IOCTL, an unsigned WDAC Code Integrity policy dropped into CiPolicies\Active, and ClipUp.exe -ppl PPL abuse (EDR-Freeze) against MsMpEng.exe, plus regsvr32 proxy execution of goldendays.dll and the MicrosoftSoftware2ShadowCop4yProvider persistence service.
references:
    - https://www.elastic.co/security-labs/roningloader
    - https://www.picussecurity.com/resource/blog/dragon-breath-apt-q-27-roningloader-and-gh0st-rat-explained
author: Threadlinqs Team
date: 2026-08-12
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1553.006
    - attack.t1553.002
    - attack.t1218.010
    - attack.t1055
    - attack.persistence
    - attack.t1543.003
    - attack.privilege-escalation
    - attack.t1548.002
    - attack.discovery
    - attack.t1518.001
    - attack.tool.ollama_sys
    - attack.group.dragon-breath
logsource:
    category: driver_load
    product: windows
detection:
    sel_driver:
        ImageLoaded|endswith: '\ollama.sys'
    sel_hash:
        Hashes|contains: '2515B546125D20013237AEADEC5873E6438ADA611347035358059A77A32C54F5'
    condition: sel_driver or sel_hash
falsepositives:
    - Legitimate use of a differently-purposed driver that happens to share the ollama.sys filename in an unrelated software package (verify hash before triage)
level: critical
---
title: RONINGLOADER Unsigned WDAC Code Integrity Policy Drop
id: 5f8b3d12-2a4e-4c9f-b6d1-8e0a3f5c7b92
status: experimental
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\Windows\System32\CodeIntegrity\CiPolicies\Active\'
        TargetFilename|endswith: '.cip'
    condition: selection
falsepositives:
    - Authorized WDAC policy management via enterprise MDM (verify against change-management ticket and require the policy to be signed)
level: high
---
title: ClipUp.exe PPL Abuse Against Windows Defender (EDR-Freeze)
id: 1e6a9c33-4d7f-4b2a-9e1c-3f8d5b0a6c17
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ClipUp.exe'
        CommandLine|contains: '-ppl'
        CommandLine|contains: 'MsMpEng.exe'
    condition: selection
falsepositives:
    - None known; ClipUp.exe -ppl targeting MsMpEng.exe outside a Defender platform update package is highly anomalous
level: critical

Known false positives:

• Legitimate enterprise WDAC policy rollouts via MDM that stage a .cip file into CiPolicies\Active outside the normal signed-policy pipeline — correlate with change-management records before escalating

Tuning notes: Treat the ollama.sys driver-load and ClipUp -ppl/MsMpEng.exe matches as unconditional critical alerts (no legitimate FP path known); require the WDAC .cip drop to correlate with an approved change ticket before suppressing, since legitimate WDAC deployments do occur via MDM.

• 🔒 RONINGLOADER Trojanized NSIS/MSI Installer Chain (Chrome/Teams Impersonation) · unlock with TL Creds
• 🔒 ollama.sys Signed-Driver AV/EDR Kill + Unsigned WDAC Policy Drop + ClipUp PPL Defender Tampering · unlock with TL Creds
• 🔒 Golden Gh0st RAT WebSocket C2 / Legacy Gh0st RAT TCP C2 + Browser Credential, Keylog, and Clipboard-Hijack Collection · unlock with TL Creds
• 🔒 RONINGLOADER Trojanized NSIS/MSI Installer Chain (Chrome/Teams Impersonation) · unlock with TL Creds
• 🔒 ollama.sys Signed-Driver AV/EDR Kill + Unsigned WDAC Policy Drop + ClipUp PPL Defender Tampering · unlock with TL Creds
• 🔒 Golden Gh0st RAT WebSocket C2 / Legacy Gh0st RAT TCP C2 + Browser Credential, Keylog, and Clipboard-Hijack Collection · unlock with TL Creds
• 🔒 RONINGLOADER Trojanized NSIS/MSI Installer Chain (Chrome/Teams Impersonation) · unlock with TL Creds
• 🔒 Golden Gh0st RAT WebSocket C2 / Legacy Gh0st RAT TCP C2 + Browser Credential, Keylog, and Clipboard-Hijack Collection · unlock with TL Creds

Indicators of compromise

As of 2026-08-12, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-1996.

Sample indicators (3 of 26)

• IP address: 23.225.147[.]227
• Domain: qaqkongtiao[.]com
• File hash: da2c58308e860e57df4c46465fd1cfc68d41e8699b4871e9a9be3c434283d50b

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

In April 2026 the group's CylindricalCanine subgroup compromised DigiCert support workstations and stole EV code-signing certificates later used to sign malware including Zhong Stealer.

Dragon Breath (tracked as APT-Q-27, Golden Eye Dog/GoldenEyeDog, and Miuuti Group) is a Chinese-language cybercrime APT first documented in 2020, historically distributing trojanized Telegram, LetsVPN, and WhatsApp installers via watering-hole sites and BlackSEO/malvertising to Chinese-speaking victims across China, Hong Kong, Taiwan, Singapore, Japan, and the Philippines, with a focus on the online-gambling and financial-services communities. A May 2023 Sophos report documented a 'double DLL side-loading' evolution in which a first clean application side-loads a second clean application, which in turn side-loads the malicious loader DLL — evasion of security-vendor sideloading blocklists via added indirection.

Beginning in November 2025, Elastic Security Labs documented RONINGLOADER, a substantially more sophisticated multi-stage loader distributed via trojanized NSIS installers impersonating Google Chrome and Microsoft Teams. The chain runs an MSI dropper (klklznuah.msi) that extracts nested NSIS installers, one benign and one malicious (Snieoatwtregoable.exe/.dll), which decrypts an embedded payload (tp.png) via a ROR+XOR routine and injects shellcode. The payload enumerates and terminates Chinese AV/EDR products (Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, Qihoo 360 Total Security, Huorong Security) using a validly signed kernel driver, ollama.sys (signed by Kunming Wuqi E-commerce Co., Ltd., cert valid Feb 2025–Feb 2026), which exposes IOCTL 0x222000 for privileged process termination via ZwOpenProcess/ZwTerminateProcess. Elastic pivoted on the signing certificate and found 71 additional signed binaries, suggesting a leaked/compromised code-signing credential well before the confirmed April 2026 DigiCert breach.

The loader further tampers with Windows Defender by directory-link abuse (mklink of a fake Defender Platform path) combined with Protected Process Light (PPL) abuse via ClipUp.exe -ppl (based on the August 2025 'Zero Salarium'/EDR-Freeze public disclosure), overwriting MsMpEng.exe with junk data to persistently disable Defender. It also deploys an unsigned WDAC Code Integrity policy (Enabled:Unsigned System Integrity Policy) into C:\Windows\System32\CodeIntegrity\CiPolicies\Active that deny-lists Qihoo 360 and Huorong executables (360rp.exe, 360sd.exe, 360Safe.exe, 360Tray.exe, ZhuDongFangYu.exe, ARPProte.exe, HipsMain.exe, HipsDaemon.exe, HipsTray.exe, and all Huorong-signed binaries by certificate TBS hash). Final-stage code (goldendays.dll, loaded via regsvr32.exe proxy execution and run as the service 'MicrosoftSoftware2ShadowCop4yProvider') uses thread-pool-based process injection (CreateThreadpoolWait/ZwAssociateWaitCompletionPacket, NtCreateSection/NtMapViewOfSection) into TrustedInstaller.exe, elevation_service.exe, taskhostw.exe, ctfmon.exe, RuntimeBroker.exe, sihost.exe, SecurityHealthSystray.exe, and vssvc.exe to run the final payload, a modified Gh0st RAT (6uf9i.exe), with persistence maintained by a watchdog batch script.

The Gh0st RAT variant steals browser credentials from Chrome, Firefox, 360se.exe, 360chrome.exe, and QQBrowser.exe (Login Data / FormData3.dat / history databases), logs keystrokes via DirectInput8 to microsoft.dotnet.common.log, monitors and hijacks the clipboard (including a cryptocurrency-wallet address swap function tied to C2 command ID 243, tracking MetaMask via the '狐狸系列' string), and clears Windows Event Logs. Its 2026 successor, Golden Gh0st RAT, replaces the original raw-TCP C2 with a WebSocket-based protocol over an HTTP upgrade handshake on non-standard ports (5188/5198, e.g., uu.goldeyeuu.io and api.keensie.com), using a custom encrypted frame format and RC4-keyed command decryption.

In parallel, Palo Alto Networks Unit 42 tracked two large-scale 2025 impersonation campaigns ('Campaign Trio', Feb–Mar 2025, spoofing i4tools/Youdao/DeepSeek across 2,000+ domains; 'Campaign Chorus', from May 2025, spoofing 40+ applications including QQ Music and Sogou) delivering Gh0st RAT via increasingly complex, signed-software-abusing infection chains — consistent with the same actor's evolution toward RONINGLOADER-class tooling.

In April 2026, a Dragon Breath subgroup Expel has named CylindricalCanine compromised code-signing certificate provider DigiCert. The actor contacted DigiCert's customer support via chat and delivered a ZIP disguised as a customer screenshot containing a malicious .scr executable (Golden Gh0st Loader), compromising two support-analyst workstations. Using the support portal's authenticated customer-account access function, the actor obtained initialization codes for pending EV Code Signing certificate orders, which combined with approved orders were functionally sufficient to issue certificates across multiple customer accounts. DigiCert and partner CAs subsequently revoked 60 certificates, 27 of which are explicitly linked to the actor; stolen certificates were used to sign Zhong Stealer (first documented by ANY.RUN in February 2025) and other Dragon Breath malware, extending the group's pattern of certificate abuse first inferred from the ollama.sys pivot.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1218.010 System Binary Proxy Execution: Regsvr32

Collection

T1056.001 Input Capture: Keylogging

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Persistence

T1136.001 Create Account: Local Account; T1543.003 Create or Modify System Process: Windows Service

Discovery

T1518.001 Security Software Discovery

Privilege Escalation

T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing; T1553.006 Subvert Trust Controls: Code Signing Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1686 Disable or Modify System Firewall

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Initial Access

T1566.001 Phishing: Spearphishing Attachment

stealth

T1574.001 DLL

Remediation

Patches

• No CVE or vendor patch applies — this is a living-off-the-land, signed-driver, and code-signing-certificate abuse chain, not a software vulnerability; mitigation is detection- and policy-based

Immediate actions

• Block known Dragon Breath/RONINGLOADER C2 and distribution domains/IPs (qaqkongtiao.com, uu.goldeyeuu.io, api.keensie.com, nsjdhmdjs.com, telegramos.org, xiazailianjieoss.com, xiaobaituziha.com, xiaofeige.icu, yqmqhjgn.com, djbzdhygj.com, 23.225.147.227, 154.82.84.227, 95.173.197.195) at DNS/proxy/firewall
• Hunt for and quarantine ollama.sys (SHA256 2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5) and any other binaries signed by certificates pivoted from it or from the DigiCert April 2026 incident
• Enforce certificate revocation checking (CRL/OCSP) at endpoints and distrust the 60 certificates revoked by DigiCert/partner CAs in connection with the CylindricalCanine incident
• Alert on unsigned Code Integrity policy loads into C:\Windows\System32\CodeIntegrity\CiPolicies\Active and on ClipUp.exe invoked with -ppl against non-standard target paths (PPL/EDR-Freeze abuse pattern)

Workarounds

• Restrict kernel driver loading to an enterprise-managed allow-list so a validly-signed but unknown driver (e.g., ollama.sys) cannot load even though its certificate chain validates
• Restrict or alert on regsvr32.exe and ClipUp.exe execution via application control where not required for business use

Longer-term hardening

• Deploy EDR with PPL/ELAM tamper-detection and kernel-driver allow-listing (WDAC/HVCI) instead of relying solely on consumer AV signature detection
• Harden CA/vendor support workflows against attachment-borne compromise: sandbox all customer-submitted files in support-ticket/chat channels, remove local admin rights from support workstations, and enforce phishing-resistant MFA on any portal with authenticated customer-account access
• Monitor for thread-pool-based process injection (CreateThreadpoolWait/ZwAssociateWaitCompletionPacket, NtCreateSection/NtMapViewOfSection) targeting TrustedInstaller.exe, elevation_service.exe, vssvc.exe, and other high-trust processes
• Implement browser credential-store hardening (App-Bound Encryption / OS Credential Guard) to blunt Login Data / FormData theft handlers used by Gh0st RAT variants

Affected and fixed versions

• Microsoft — Windows Defender Antivirus / WDAC Code Integrity policy engine
  Vulnerable versions: Windows 10; Windows 11; Windows Server
• Qihoo 360 — 360 Total Security / 360 Safe / ZhuDongFangYu
  Vulnerable versions: all versions targeted by IOCTL/CI-policy termination
• Kingsoft — Kingsoft Internet Security
  Vulnerable versions: all versions targeted
• Tencent — Tencent PC Manager / QQ Browser
  Vulnerable versions: all versions targeted
• Huorong — Huorong Security (Sysdiag / ARPProte)
  Vulnerable versions: all versions targeted
• DigiCert — EV Code Signing certificate issuance / customer support portal
  Vulnerable versions: support-portal customer-account access workflow (pre-April 2026)
  Fixed in: 60 certificates revoked across 4 CAs post-incident, per Expel

Timeline

• 2020-01-01 Dragon Breath (APT-Q-27/Golden Eye Dog) first documented using watering-hole sites distributing trojanized Telegram installers.
• 2022-05-01 Continued abuse of fake Telegram/LetsVPN/WhatsApp installers to deploy Gh0st RAT to Chinese-speaking gambling-sector victims.
• 2023-05-03 Sophos publishes 'A doubled Dragon Breath' detailing the double-clean-app DLL side-loading evolution used against gambling-focused targets.
• 2025-02-01 Zhong Stealer, later signed with certificates stolen in the April 2026 DigiCert incident, is first documented by ANY.RUN.
• 2025-02-15 Unit 42 tracks 'Campaign Trio' — 2,000+ domains impersonating i4tools, Youdao, and DeepSeek to deliver Gh0st RAT via MSI droppers.
• 2025-05-15 Unit 42 tracks 'Campaign Chorus' — 40+ impersonated applications (QQ Music, Sogou, etc.) using VBScript droppers and DLL side-loading (wsc_proxy.exe/wsc.dll).
• 2025-08-01 Zero Salarium publicly discloses the ClipUp.exe PPL-abuse (EDR-Freeze) technique that RONINGLOADER adopts within weeks.
• 2025-09-01 Elastic Security Labs identifies a live RONINGLOADER campaign via telemetry-based threat hunting, distributed through trojanized Chrome/Teams NSIS installers.
• 2025-11-15 Elastic Security Labs publishes 'RONINGLOADER: DragonBreath's New Path to PPL Abuse,' detailing the ollama.sys driver, WDAC policy abuse, and full IOC set.
• 2026-01-01 Continued RONINGLOADER activity identified into January 2026, per subsequent reporting on the GoldenEyeDog cluster.
• 2026-04-01 CylindricalCanine subgroup compromises two DigiCert support-analyst workstations via a malicious .scr disguised as a customer screenshot sent through DigiCert's support chat, then abuses the support portal to obtain EV Code Signing certificate initialization codes.
• 2026-07-17 Expel publishes 'Introducing CylindricalCanine,' attributing the April 2026 DigiCert breach to a GoldenEyeDog/Dragon Breath subgroup; DigiCert and partner CAs revoke 60 certificates (27 explicitly linked to the actor).
• 2026-08-12 Picus Security publishes a consolidated Dragon Breath/RONINGLOADER/Gh0st RAT/DigiCert writeup synthesizing the Elastic, Sophos, and Expel reporting.

Sources cited

• RONINGLOADER: DragonBreath's New Path to PPL Abuse elastic.co · Research · 2025-11-15
• Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT Unit 42 · Research · 2025-08-01
• Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained picussecurity.com · Blog · 2026-08-12
• A doubled "Dragon Breath" adds new air to DLL sideloading attacks Sophos · Blog · 2023-05-03
• Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident expel.com · Blog · 2026-07-17
• GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft The Hacker News · News · 2026-07-17
• Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT The Hacker News · News · 2025-11-15

Related threats

• GoldenEyeDog / CylindricalCanine Breaches DigiCert Support System to Hijack EV Code-Signing Certificates for Golden Gh0st RAT and Zhong Stealer Distribution

More from DragonBreath

• CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639

Previous and next in malware

• WindRelay + SpyNote Combo: NFC Relay Malware Enables Contactless Card Fraud Across Central/Eastern Europe Previous report
• WindRelay Android NFC Relay Malware Paired With SpyNote RAT Enables Real-Time Bank Card "Ghost Tapping" Fraud Next report