Threats Tagged 'thread-pool injection'

RONINGLOADER is a sophisticated multi-stage malware loader used by the DragonBreath APT group to deploy an updated variant of the gh0st RAT. It begins infection via trojanized NSIS installers disguised as legitimate software and employs advanced evasion techniques including signed driver abuse, thread-pool injection, and Protected Process Light (PPL) exploitation to disable Microsoft Defender. The loader terminates antivirus processes, applies custom Windows Defender Application Control (WDAC) policies, and injects payloads into trusted system processes to avoid detection. This campaign targets Chinese EDR tools but demonstrates advanced tactics that could be adapted elsewhere. The malware’s complexity and stealth capabilities pose a medium severity threat, with potential impacts on confidentiality and integrity. European organizations using Windows environments with Microsoft Defender could be at risk, especially those in critical infrastructure and government sectors. Mitigation requires tailored detection of abnormal driver behavior, WDAC policy monitoring, and restricting installation of unsigned drivers. Countries with high adoption of Microsoft Defender and strategic geopolitical interest in China-related espionage are most likely affected.

MediumMalwareGermanyFranceNetherlands+5#driver abuse#ppl abuse#wdac