APT-Q-27 Dragon Breath: RONINGLOADER and Gh0st RAT Analysis

Summary

Dragon Breath is a Chinese cybercrime APT targeting Chinese-speaking users across the Asia-Pacific region. The group employs advanced techniques including trojanized installers, DLL side-loading, and signed kernel drivers to deploy the RONINGLOADER infection chain and customized Gh0st RAT variants. The actors have also demonstrated the ability to compromise certificate providers and obtain code-signing material for their malware.

Investigation

The report examines Dragon Breath’s evolution from 2020 through 2026, documenting its shift from watering-hole attacks to advanced DLL side-loading and Protected Process Light (PPL) abuse. It highlights a 2026 intrusion involving DigiCert, where the group reportedly obtained code-signing material. The analysis also covers multiple injection techniques, including thread-pool object abuse and kernel-mode process termination.

Mitigation

Organizations should validate endpoint security controls against simulated Dragon Breath attack techniques and strengthen protections around application execution. Strict application control policies should be enforced, while defenders monitor for unauthorized service creation and suspicious DLL side-loading. Detecting abuse of Protected Process Light (PPL) and unauthorized or unsigned WDAC policies is also critical.

Response

If Dragon Breath activity is detected, affected hosts should be isolated immediately and investigated for unauthorized local accounts and persistence through Windows Services. Responders should closely examine process injection activity involving trusted system processes such as TrustedInstaller.exe or taskhostw.exe. Code-signing certificates should be validated, and modifications to Windows Defender or regional security products should be reviewed.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and is attempting to establish a persistent Command and Control (C2) channel. To evade traditional signature-based detection and firewalls that only look for standard HTTP/S requests, the attacker deploys a lightweight agent that initiates a WebSocket upgrade request. By transitioning from a standard HTTP GET request to a WebSocket connection, the attacker establishes a full-duplex communication channel, allowing them to issue commands and receive data (like keystrokes or file exfiltration) in real-time under the guise of persistent web traffic.

• Regression Test Script:

    # Simulation script to mimic a WebSocket handshake/connection
    # This uses a PowerShell socket implementation to initiate a WebSocket-style connection.
    # Note: This requires an active listener or a public WebSocket echo service for success.
  
    $wsUri = "wss://echo.websocket.org" # Using a public echo service for simulation
    Write-Host "[*] Attempting to establish WebSocket connection to $wsUri..."
  
    try {
        $ws = New-Object System.Net.WebSockets.ClientWebSocket
        $ct = New-Object System.Threading.CancellationTokenSource
        $connectTask = $ws.ConnectAsync($wsUri, $ct.Token)
  
        # Wait for connection to simulate the 'Network Connection' event
        if ($connectTask.Wait(10000)) {
            Write-Host "[+] WebSocket connection established successfully."
            Write-Host "[!] Check your SIEM for 'Protocol: WebSocket' alerts."
  
            # Send a small heartbeat to keep the socket open
            $buffer = [System.Text.Encoding]::UTF8.GetBytes("Ping")
            $sendTask = $ws.SendAsync((New-Object ArraySegment[byte]($buffer)), [System.Net.WebSockets.WebSocketMessageType]::Text, $true, $ct.Token)
            $sendTask.Wait(5000)
  
            # Hold connection briefly to ensure telemetry capture
            Start-Sleep -Seconds 10
            $ws.CloseAsync([System.Net.WebSockets.WebSocketCloseStatus]::NormalClosure, "Closing", $ct.Token).Wait()
        } else {
            Write-Host "[-] Connection timed out. Ensure the target can reach the WebSocket URI."
        }
    } catch {
        Write-Error "[-] Error during simulation: $($_.Exception.Message)"
    } finally {
        if ($ws) { $ws.Dispose() }
    }

• Cleanup Commands:

    # No persistent artifacts are created by the PowerShell script.
    # Ensure any manually opened connections are closed.
    Write-Host "[*] Cleaning up simulation environment..."
    Stop-Process -Name "powershell" -ErrorAction SilentlyContinue