RONINGLOADER Uses Signed Drivers to Disable Microsoft Defender and Bypass EDR

According to Elastic Security Labs, a campaign deploying a newly identified loader, dubbed RONINGLOADER, weaponises legitimately signed kernel drivers to systematically disable Microsoft Defender and evade EDR tools, with the activity attributed to the Dragon Breath APT group (APT-Q-27).

The operation uses a signed kernel driver named ollama.sys issued by Kunming Wuqi E-commerce Co., Ltd, with a certificate valid through February 2026, to terminate security processes from kernel mode and employs a four-stage infection chain beginning with trojanised NSIS installers.

Stage Two identifies running security processes and terminates antivirus solutions including Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, Qihoo 360 Total Security, and Huorong Security, aided by WDAC policy controls and PPL abuse such as ClipUp.exe to overwrite MsMpEng.exe, disabling Defender even after reboot.

The campaign also uses phantom DLL side-loading, thread pool injection, and firewall manipulation to isolate security software, and Stage Three/Four inject a modified gh0st RAT into trusted system processes, enabling encrypted C2 traffic, keystroke logging, clipboard hijacking, and wallet monitoring with focus on cryptocurrency targets. Elastic researchers noted 71 additional signed binaries using the same certificate, suggesting broader abuse of legitimate signed drivers.