Dragon Breath, a threat actor, has been observed deploying the multi-stage loader RONINGLOADER to distribute a modified version of the remote access trojan Gh0st RAT. The campaign, as reported by Elastic Security Labs, primarily targets Chinese-speaking users by disguising malicious NSIS installers as legitimate applications like Google Chrome and Microsoft Teams.
Attack Strategies and Evasion
The infection chain employs several evasion techniques. These include the use of a legitimately signed driver, custom Windows Defender Application Control (WDAC) policies, and manipulation of Microsoft Defender protected processes. The dropped NSIS installer executes two binaries: a benign installer and a covert one that delivers a DLL and extracts shellcode to launch in-memory binaries.
RONINGLOADER actively scans and disables common antivirus and endpoint security products such as Microsoft Defender and Qihoo360. For Qihoo360, it modifies firewall rules, injects shellcode, and utilizes a signed driver to terminate processes temporarily. It then resets the firewall settings.
Payload and Execution
After disabling security protections, RONINGLOADER bypasses User Account Control (UAC), creates new firewall rules, and manipulates Windows Error Reporting to deactivate Defender. It installs malicious WDAC policies targeting Chinese security solutions and injects a rogue DLL into regsvr32.exe to obscure activity. The sequence culminates with launching the modified Gh0st RAT payload into high-privilege processes like TrustedInstaller.exe.
The end payload engages in various malicious activities: altering system configurations, capturing keystrokes, clipboard contents, and window titles, as well as other intrusive actions.
Expanded Campaigns
Apart from the documented campaign, Palo Alto Networks Unit 42 observed two interconnected operations: Campaign Trio and Campaign Chorus. Running from February to May 2025, these efforts impersonated numerous services and applications to deploy Gh0st RAT, demonstrating the adversary's evolving tactics by shifting from simple droppers to sophisticated, multi-stage attack chains.
