# Dragon Breath (APT-Q-27) Deploys RONINGLOADER to Disable Security Tools and Drop Gh0st RAT

> Chinese cybercrime group Dragon Breath (APT-Q-27, Golden Eye Dog/GoldenEyeDog) uses the multi-stage RONINGLOADER, a validly-signed kernel driver (ollama.sys), an unsigned WDAC policy, and ClipUp.exe/PPL abuse to blind Chinese AV/EDR tools before injecting a modified Gh0st RAT — now a WebSocket-based 'Golden Gh0st RAT' variant. In April 2026 the group's CylindricalCanine subgroup compromised DigiCert support workstations and stole EV code-signing certificates later used to sign malware including Zhong Stealer.

- **Published:** 2026-08-12T00:00:00Z
- **Last reviewed:** 2026-08-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1996
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-dragon-breath-roningloader-campaign-tl-2026-1996.webp?v=1e588083 (Threadlinqs threat intel: Dragon Breath Kernel Loader: Detection & IOCs (TL-2026-1996) — High severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-1996
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Dragon Breath (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

Dragon Breath (tracked as APT-Q-27, Golden Eye Dog/GoldenEyeDog, and Miuuti Group) is a Chinese-language cybercrime APT first documented in 2020, historically distributing trojanized Telegram, LetsVPN, and WhatsApp installers via watering-hole sites and BlackSEO/malvertising to Chinese-speaking victims across China, Hong Kong, Taiwan, Singapore, Japan, and the Philippines, with a focus on the online-gambling and financial-services communities. A May 2023 Sophos report documented a 'double DLL side-loading' evolution in which a first clean application side-loads a second clean application, which in turn side-loads the malicious loader DLL — evasion of security-vendor sideloading blocklists via added indirection.

Beginning in November 2025, Elastic Security Labs documented RONINGLOADER, a substantially more sophisticated multi-stage loader distributed via trojanized NSIS installers impersonating Google Chrome and Microsoft Teams. The chain runs an MSI dropper (klklznuah.msi) that extracts nested NSIS installers, one benign and one malicious (Snieoatwtregoable.exe/.dll), which decrypts an embedded payload (tp.png) via a ROR+XOR routine and injects shellcode. The payload enumerates and terminates Chinese AV/EDR products (Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, Qihoo 360 Total Security, Huorong Security) using a validly signed kernel driver, ollama.sys (signed by Kunming Wuqi E-commerce Co., Ltd., cert valid Feb 2025–Feb 2026), which exposes IOCTL 0x222000 for privileged process termination via ZwOpenProcess/ZwTerminateProcess. Elastic pivoted on the signing certificate and found 71 additional signed binaries, suggesting a leaked/compromised code-signing credential well before the confirmed April 2026 DigiCert breach.

The loader further tampers with Windows Defender by directory-link abuse (mklink of a fake Defender Platform path) combined with Protected Process Light (PPL) abuse via ClipUp.exe -ppl (based on the August 2025 'Zero Salarium'/EDR-Freeze public disclosure), overwriting MsMpEng.exe with junk data to persistently disable Defender. It also deploys an unsigned WDAC Code Integrity policy (Enabled:Unsigned System Integrity Policy) into C:\Windows\System32\CodeIntegrity\CiPolicies\Active that deny-lists Qihoo 360 and Huorong executables (360rp.exe, 360sd.exe, 360Safe.exe, 360Tray.exe, ZhuDongFangYu.exe, ARPProte.exe, HipsMain.exe, HipsDaemon.exe, HipsTray.exe, and all Huorong-signed binaries by certificate TBS hash). Final-stage code (goldendays.dll, loaded via regsvr32.exe proxy execution and run as the service 'MicrosoftSoftware2ShadowCop4yProvider') uses thread-pool-based process injection (CreateThreadpoolWait/ZwAssociateWaitCompletionPacket, NtCreateSection/NtMapViewOfSection) into TrustedInstaller.exe, elevation_service.exe, taskhostw.exe, ctfmon.exe, RuntimeBroker.exe, sihost.exe, SecurityHealthSystray.exe, and vssvc.exe to run the final payload, a modified Gh0st RAT (6uf9i.exe), with persistence maintained by a watchdog batch script.

The Gh0st RAT variant steals browser credentials from Chrome, Firefox, 360se.exe, 360chrome.exe, and QQBrowser.exe (Login Data / FormData3.dat / history databases), logs keystrokes via DirectInput8 to microsoft.dotnet.common.log, monitors and hijacks the clipboard (including a cryptocurrency-wallet address swap function tied to C2 command ID 243, tracking MetaMask via the '狐狸系列' string), and clears Windows Event Logs. Its 2026 successor, Golden Gh0st RAT, replaces the original raw-TCP C2 with a WebSocket-based protocol over an HTTP upgrade handshake on non-standard ports (5188/5198, e.g., uu.goldeyeuu.io and api.keensie.com), using a custom encrypted frame format and RC4-keyed command decryption.

In parallel, Palo Alto Networks Unit 42 tracked two large-scale 2025 impersonation campaigns ('Campaign Trio', Feb–Mar 2025, spoofing i4tools/Youdao/DeepSeek across 2,000+ domains; 'Campaign Chorus', from May 2025, spoofing 40+ applications including QQ Music and Sogou) delivering Gh0st RAT via increasingly complex, signed-software-abusing infection chains — consistent with the same actor's evolution toward RONINGLOADER-class tooling.

In April 2026, a Dragon Breath subgroup Expel has named CylindricalCanine compromised code-signing certificate provider DigiCert. The actor contacted DigiCert's customer support via chat and delivered a ZIP disguised as a customer screenshot containing a malicious .scr executable (Golden Gh0st Loader), compromising two support-analyst workstations. Using the support portal's authenticated customer-account access function, the actor obtained initialization codes for pending EV Code Signing certificate orders, which combined with approved orders were functionally sufficient to issue certificates across multiple customer accounts. DigiCert and partner CAs subsequently revoked 60 certificates, 27 of which are explicitly linked to the actor; stolen certificates were used to sign Zhong Stealer (first documented by ANY.RUN in February 2025) and other Dragon Breath malware, extending the group's pattern of certificate abuse first inferred from the ollama.sys pivot.

## MITRE ATT&CK

- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1218.010 System Binary Proxy Execution: Regsvr32
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1543.003 Create or Modify System Process: Windows Service
- T1136.001 Create Account: Local Account
- T1574.001 DLL
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1553.006 Subvert Trust Controls: Code Signing Policy Modification
- T1553.002 Subvert Trust Controls: Code Signing
- T1685.005 Clear Windows Event Logs
- T1027 Obfuscated Files or Information
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1518.001 Security Software Discovery
- T1056.001 Input Capture: Keylogging
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ollama.sys Signed-Driver AV/EDR Kill + Unsigned WDAC Policy Drop + ClipUp PPL Defender Tampering** (`TL-2026-1996-SPL-002`)

Detects the RONINGLOADER security-tool-blinding stage: load of the validly-signed but abused ollama.sys kernel driver (which exposes IOCTL 0x222000 for privileged ZwOpenProcess/ZwTerminateProcess against Chinese AV/EDR processes), deployment of the unsigned WDAC Code Integrity policy into CiPolicies\Active, and ClipUp.exe -ppl invoked against a fake Defender path to overwrite MsMpEng.exe (EDR-Freeze/PPL abuse). Also covers regsvr32 proxy execution of goldendays.dll and creation of the MicrosoftSoftware2ShadowCop4yProvider persistence service.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1562.001, T1553.006, T1553.002, T1218.010, T1055, T1543.003, T1548.002, T1518.001
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=6 OR EventCode=11 OR EventCode=1 OR EventCode=7))
| eval cl=lower(CommandLine), img=lower(Image), tgt=lower(TargetFilename)
| where (EventCode=6 AND (ImageLoaded LIKE "%ollama.sys" OR Hashes LIKE "%2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5%"))
   OR (EventCode=11 AND tgt LIKE "%\\windows\\system32\\codeintegrity\\cipolicies\\active\\%.cip")
   OR (EventCode=1 AND img LIKE "%\\clipup.exe" AND cl LIKE "%-ppl%" AND cl LIKE "%msmpeng.exe%")
   OR (EventCode=1 AND img LIKE "%\\regsvr32.exe" AND cl LIKE "%goldendays.dll%")
| stats count min(_time) as first_seen values(CommandLine) as cmd values(TargetFilename) as target values(ImageLoaded) as driver by ComputerName, User, EventCode, Image
| where count > 0

``` companion query: service creation ```
 index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
| search ServiceName="MicrosoftSoftware2ShadowCop4yProvider"
| table _time, ComputerName, ServiceName, ServiceFileName, StartType
````

### Microsoft KQL

```kql
let driver_load = DeviceEvents
| where Timestamp > ago(24h) and ActionType == "DriverLoad"
| where FileName =~ "ollama.sys" or SHA256 == "2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5";
let wdac_drop = DeviceFileEvents
| where Timestamp > ago(24h) and FolderPath has @"\Windows\System32\CodeIntegrity\CiPolicies\Active\" and FileName endswith ".cip";
let ppl_abuse = DeviceProcessEvents
| where Timestamp > ago(24h) and FileName =~ "ClipUp.exe" and ProcessCommandLine has "-ppl" and ProcessCommandLine has "MsMpEng.exe";
let regsvr32_proxy = DeviceProcessEvents
| where Timestamp > ago(24h) and FileName =~ "regsvr32.exe" and ProcessCommandLine has "goldendays.dll";
driver_load | union wdac_drop | union ppl_abuse | union regsvr32_proxy
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: RONINGLOADER Security-Tool Blinding via ollama.sys, Unsigned WDAC Policy, and ClipUp PPL Abuse
id: 9c2e4a71-8b1d-4f0c-a3e5-1d6f7c9b2a44
status: experimental
description: Detects RONINGLOADER's AV/EDR-blinding stage -- signed kernel driver ollama.sys loading with a known privileged-termination IOCTL, an unsigned WDAC Code Integrity policy dropped into CiPolicies\Active, and ClipUp.exe -ppl PPL abuse (EDR-Freeze) against MsMpEng.exe, plus regsvr32 proxy execution of goldendays.dll and the MicrosoftSoftware2ShadowCop4yProvider persistence service.
references:
    - https://www.elastic.co/security-labs/roningloader
    - https://www.picussecurity.com/resource/blog/dragon-breath-apt-q-27-roningloader-and-gh0st-rat-explained
author: Threadlinqs Team
date: 2026-08-12
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1553.006
    - attack.t1553.002
    - attack.t1218.010
    - attack.t1055
    - attack.persistence
    - attack.t1543.003
    - attack.privilege-escalation
    - attack.t1548.002
    - attack.discovery
    - attack.t1518.001
    - attack.tool.ollama_sys
    - attack.group.dragon-breath
logsource:
    category: driver_load
    product: windows
detection:
    sel_driver:
        ImageLoaded|endswith: '\ollama.sys'
    sel_hash:
        Hashes|contains: '2515B546125D20013237AEADEC5873E6438ADA611347035358059A77A32C54F5'
    condition: sel_driver or sel_hash
falsepositives:
    - Legitimate use of a differently-purposed driver that happens to share the ollama.sys filename in an unrelated software package (verify hash before triage)
level: critical
---
title: RONINGLOADER Unsigned WDAC Code Integrity Policy Drop
id: 5f8b3d12-2a4e-4c9f-b6d1-8e0a3f5c7b92
status: experimental
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\Windows\System32\CodeIntegrity\CiPolicies\Active\'
        TargetFilename|endswith: '.cip'
    condition: selection
falsepositives:
    - Authorized WDAC policy management via enterprise MDM (verify against change-management ticket and require the policy to be signed)
level: high
---
title: ClipUp.exe PPL Abuse Against Windows Defender (EDR-Freeze)
id: 1e6a9c33-4d7f-4b2a-9e1c-3f8d5b0a6c17
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ClipUp.exe'
        CommandLine|contains: '-ppl'
        CommandLine|contains: 'MsMpEng.exe'
    condition: selection
falsepositives:
    - None known; ClipUp.exe -ppl targeting MsMpEng.exe outside a Defender platform update package is highly anomalous
level: critical
```

**Known false positives:**

- Legitimate enterprise WDAC policy rollouts via MDM that stage a .cip file into CiPolicies\Active outside the normal signed-policy pipeline — correlate with change-management records before escalating

**Tuning notes:** Treat the ollama.sys driver-load and ClipUp -ppl/MsMpEng.exe matches as unconditional critical alerts (no legitimate FP path known); require the WDAC .cip drop to correlate with an approved change ticket before suppressing, since legitimate WDAC deployments do occur via MDM.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RONINGLOADER Trojanized NSIS/MSI Installer Chain (Chrome/Teams Impersonation) (locked: unlock with TL Creds)
- ollama.sys Signed-Driver AV/EDR Kill + Unsigned WDAC Policy Drop + ClipUp PPL Defender Tampering (locked: unlock with TL Creds)
- Golden Gh0st RAT WebSocket C2 / Legacy Gh0st RAT TCP C2 + Browser Credential, Keylog, and Clipboard-Hijack Collection (locked: unlock with TL Creds)
- RONINGLOADER Trojanized NSIS/MSI Installer Chain (Chrome/Teams Impersonation) (locked: unlock with TL Creds)
- ollama.sys Signed-Driver AV/EDR Kill + Unsigned WDAC Policy Drop + ClipUp PPL Defender Tampering (locked: unlock with TL Creds)
- Golden Gh0st RAT WebSocket C2 / Legacy Gh0st RAT TCP C2 + Browser Credential, Keylog, and Clipboard-Hijack Collection (locked: unlock with TL Creds)
- RONINGLOADER Trojanized NSIS/MSI Installer Chain (Chrome/Teams Impersonation) (locked: unlock with TL Creds)
- Golden Gh0st RAT WebSocket C2 / Legacy Gh0st RAT TCP C2 + Browser Credential, Keylog, and Clipboard-Hijack Collection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `23.225.147[.]227`
- Domain: `qaqkongtiao[.]com`
- File hash: `da2c58308e860e57df4c46465fd1cfc68d41e8699b4871e9a9be3c434283d50b`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Dragon Breath (APT-Q-27): RONINGLOADER and Gh0st RAT Explained](https://www.picussecurity.com/resource/blog/dragon-breath-apt-q-27-roningloader-and-gh0st-rat-explained)
- [RONINGLOADER: DragonBreath's New Path to PPL Abuse](https://www.elastic.co/security-labs/roningloader)
- [A doubled "Dragon Breath" adds new air to DLL sideloading attacks](https://www.sophos.com/en-us/blog/doubled-dll-sideloading-dragon-breath)
- [Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident](https://expel.com/blog/introducing-cylindricalcanine/)
- [GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft](https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html)
- [Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT](https://thehackernews.com/2025/11/dragon-breath-uses-roningloader-to.html)
- [Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT](https://unit42.paloaltonetworks.com/impersonation-campaigns-deliver-gh0st-rat/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1996