MalwarePublished 19 Nov 2025

RONINGLOADER: DragonBreath's New Path to PPL Abuse

Source AlienVault OTX General

Description

RONINGLOADER is a sophisticated multi-stage malware loader used by the DragonBreath APT group to deploy an updated variant of the gh0st RAT. It begins infection via trojanized NSIS installers disguised as legitimate software and employs advanced evasion techniques including signed driver abuse, thread-pool injection, and Protected Process Light (PPL) exploitation to disable Microsoft Defender. The loader terminates antivirus processes, applies custom Windows Defender Application Control (WDAC) policies, and injects payloads into trusted system processes to avoid detection. This campaign targets Chinese EDR tools but demonstrates advanced tactics that could be adapted elsewhere. The malware’s complexity and stealth capabilities pose a medium severity threat, with potential impacts on confidentiality and integrity. European organizations using Windows environments with Microsoft Defender could be at risk, especially those in critical infrastructure and government sectors. Mitigation requires tailored detection of abnormal driver behavior, WDAC policy monitoring, and restricting installation of unsigned drivers. Countries with high adoption of Microsoft Defender and strategic geopolitical interest in China-related espionage are most likely affected.

Impact

For European organizations, the RONINGLOADER threat poses significant risks primarily to confidentiality and integrity due to the deployment of the gh0st RAT, which enables remote access, data exfiltration, and potential lateral movement within networks. The malware’s ability to disable Microsoft Defender and evade detection can lead to prolonged undetected presence, increasing the risk of espionage, intellectual property theft, and disruption of critical services. Sectors such as government, defense, critical infrastructure, and technology firms are particularly vulnerable due to their strategic value and frequent targeting by APT groups. The use of trojanized installers as the initial infection vector means that social engineering or supply chain compromise could facilitate infection. The stealthy injection into trusted processes complicates incident response and forensic analysis. While the campaign currently targets Chinese EDR tools, the underlying techniques could be adapted to evade European security solutions, especially those relying on Microsoft Defender. The medium severity rating reflects the complexity and potential impact balanced against the current lack of widespread exploitation in Europe.

Defensive guidance

European organizations should implement advanced monitoring for abnormal driver installations and behavior, including auditing signed driver usage to detect potential abuse. Deploying enhanced WDAC policy monitoring and alerting can help identify unauthorized policy changes indicative of malware activity. Endpoint detection solutions should be tuned to detect thread-pool injection and unusual process injection behaviors, especially into trusted system processes. Restricting the installation of unsigned or unapproved drivers through group policies and application whitelisting reduces the attack surface. User education to avoid installing software from untrusted sources, particularly trojanized NSIS installers, is critical. Incident response teams should develop playbooks for handling PPL exploitation and driver abuse scenarios. Regular threat hunting focusing on indicators of compromise related to RONINGLOADER’s tactics and techniques (e.g., process termination patterns, WDAC modifications) will improve early detection. Collaboration with threat intelligence providers to stay updated on DragonBreath activity and related malware variants is recommended. Finally, network segmentation and least privilege principles limit lateral movement if initial compromise occurs.

Summary

RONINGLOADER is a multi-stage loader malware deployed by the DragonBreath advanced persistent threat (APT) group, designed to deliver an updated gh0st RAT variant. The infection chain starts with trojanized Nullsoft Scriptable Install System (NSIS) installers that masquerade as legitimate software, tricking users into executing the initial payload. RONINGLOADER employs a series of sophisticated evasion techniques to bypass endpoint detection and response (EDR) tools, particularly those used in China. Key evasion methods include abuse of signed kernel-mode drivers to gain elevated privileges, thread-pool injection to stealthily execute code within legitimate processes, and exploitation of Protected Process Light (PPL) to disable Microsoft Defender components. The loader terminates antivirus processes and applies custom Windows Defender Application Control (WDAC) policies to further weaken endpoint defenses. The final payload is injected into trusted system processes, making detection and removal challenging. This campaign reflects an evolution in DragonBreath’s tactics, emphasizing stealth, persistence, and adaptability. Although primarily targeting Chinese EDR solutions, the techniques used could be effective against other Windows environments globally. The malware’s use of driver abuse and PPL exploitation highlights the increasing sophistication of APT groups in circumventing modern security controls. No known public exploits or patches are currently available, and the campaign is ongoing as of late 2025.

Indicators of compromise

Domains 1

qaqkongtiao.com

Hashes 40

5b92b51e585ad1f235855fd86dc77b85
0bb3cff34c803295888efde782925e5b1193114f
3dd470e85fe77cd847ca59d1d08ec8ccebe9bd73fd2cf074c29d87ca2fd24e33
00893b7c3e8c39d4663257ddec678aa9
3a7cb580bd340505f6dc5b4c829a3eca
838f8f3d80f676272dd54c9811ee6ce2
8ad120e4f3e41849fefa229c9b7d3008
96dcdb8bb7934abdb6cd87c33d17be87
b10347281e6e8451a77b423f1c8286bb
c09570d0dbf0abfe506cc4370defb396

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Nov 2025, 09:27 UTC

MITRE ATT&CK techniques21 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 40

Community reviews

Related threats