DragonBreathThreat actor
- apt-q-27,
- golden eye dog
Golden Eye Dog targets Chinese-speaking users engaged in online gambling, employing techniques such as SERP poisoning, social engineering, and DDoS attacks. The group utilizes trojanized NSIS installers to deliver RONINGLOADER, which executes complex process-injection workflows and deploys a modified Gh0st RAT for espionage.From MISP Galaxy
Last reported 11 months ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 20 · each with the sentence it comes from- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1036Masquerading
“… distributing a modified variant of the gh0st RAT, attributed to the Dragon Breath APT (APT-Q-27), through trojanized NSIS installers masquerading as legitimate software such as Google Chrome and Microsoft Teams.”
- T1055Process Injection
“RONINGLOADER takes a different approach to this process injection compared to other injection methods used elsewhere in the malware.”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
RONINGLOADER: DragonBreath’s New Path to PPL Abuse“RONINGLOADER: DragonBreath’s New Path to PPL Abuse”
Indicators in its reports
named in the reports above- da2c58308e860e57…3c434283d50bin 1 report
- 82794015e2b40cc6…0edaee203724in 1 report
- c65170be2bf4f0bd…959bcaad8ae5in 1 report
- 2515b546125d2001…9a77a32c54f5in 1 report
- 1613a913d0384cbb…563a6f22f2b7in 1 report
- 395f835731d25803…59af32f6258din 1 report
- 1c1528b546aa29be…9f22a4ee37e2in 1 report
- 4d5beb8efd4ade58…35a756ed39e6in 1 report
- 96f401b80d3319f8…39bcfb07cdf0in 1 report
- 33b494eaaa6d7ed7…52c3313e617cin 1 report
- fc63f5dfc93f2358…f6041a0e01bcin 1 report
- fd4dd9904549c665…252001f1d107in 1 report
- 3dd470e85fe77cd8…87ca2fd24e33in 1 report
- qaqkongtiao[.]comin 1 report
- hxxps://nsis.sourceforge[.]io/Main_Pagein 1 report
- hxxps://github[.]com/Jemmy1228/HookSigntoolin 1 report
- hxxps://www.safebreach[.]com/blog/process-injection-using-windows-thread-pools/in 1 report
- www.safebreach[.]comin 1 report
- hxxps://hijacklibs[.]net/entries/microsoft/built-in/wow64log.htmlin 1 report
- hijacklibs[.]netin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.