Dragon Breath APT Deploys RoningLoader, Using Kernel Driver and PPL Abuse to Disable Windows Defender

Elastic Security Labs has uncovered a highly sophisticated Dragon Breath APT operation (APT-Q-27) centred on a new multi-stage loader named RoningLoader, which uses trojanised installers posing as trusted apps such as Google Chrome and Microsoft Teams. The campaign is noted for its dramatic evolution in evasion, defence bypass, and persistence, and it primarily targets Chinese-speaking users.

According to Elastic Security Labs, the attackers employ multi-layered NSIS installers, with a benign app installed to maintain legitimacy while the malicious chain runs in the background, and they abuse Protected Process Light (PPL) to disable Windows Defender. The malware uses ClipUp.exe with custom hooks to overwrite Defender binaries and then deploys a legitimately signed kernel driver, ollama.sys, signed by Kunming Wuqi E-commerce Co., Ltd., to terminate antivirus processes at the kernel level.

It also applies unsigned WDAC policies to block certain Chinese security tools, enabling the malware to run without signatures. The RoningLoader chain culminates in a lightly updated version of Gh0st RAT, delivering remote command execution, keylogging, clipboard monitoring, and C2 communications, with a notable remote configuration of a clipboard hijacker for cryptocurrency addresses.