Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor known as Dragon Breath has been observed using a multi-stage loader codenamed RONINGLOADER to deliver a modified Gh0st RAT payload, targeting Chinese-speaking users. Elastic Security Labs says the campaign relies on trojanised NSIS installers masquerading as legitimate applications such as Google Chrome and Microsoft Teams, with a two-stage embedded delivery where one NSIS binary installs legitimate software and the second triggers the attack chain.

RONINGLOADER reportedly aims to disable security tools by terminating processes such as Microsoft Defender Antivirus and Qihoo 360 Total Security, and to block network communication via firewall changes after killing security processes. It attempts privilege escalation with runas, wipes traces by injecting into system processes, and uses a signed driver named ollama.sys via a temporary service to terminate security tools, before restoring firewall settings.

The final payload is a modified Gh0st RAT, with capabilities to fetch instructions from a remote server, configure Windows Registry keys, clear event logs, and execute commands, while also incorporating keystroke and clipboard data capture. In a related Brand impersonation campaign, Dragon Breath operations are described as evolving from simple droppers to complex, multi-stage chains that abuse legitimate signed software to bypass defenses.