Dragon Breath

THREAT ACTOR PROFILE

Dragon Breath

APT-Q-27

Dragon Breath is a Chinese APT active since around 2020 that targets Chinese-speaking organizations across the Asia-Pacific, especially in the gambling and finance sectors. It uses trojanized installers and layered DLL sideloading to deliver a modified Gh0st RAT via the RONINGLOADER loader, and it has moved into code-signing certificate abuse and BYOVD kernel attacks.

Country:

China

Gambling / Finance

First seen

2020

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Dragon Breath, APT-Q-27 and Golden Eye Dog

Dragon Breath is tracked under several vendor names tied to its APAC operations. It maps to one entry among the China-nexus espionage actors we track, and its trojanized-installer and sideloading tradecraft overlaps with other China-linked crews like Mustang Panda.

GROUP PROFILE

Layered sideloading into Gh0st RAT

Dragon Breath is a China-linked actor that blends espionage and cybercrime against the Chinese-speaking gambling and finance scene. It favors trojanized installers for popular software and VPNs, and complex DLL sideloading chains that hide its final payload.

Our record places its origin as China and ties it to activity against Chinese-speaking APAC organizations. The group has been linked to a 2026 DigiCert breach in which operators tricked support staff to obtain code-signing certificate material to sign malware.

Its tradecraft includes double clean-app DLL sideloading, the RONINGLOADER loader, a modified Gh0st RAT, the Zhong Stealer, and a WHQL-signed kernel driver used for BYOVD attacks against protected processes.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Trojanized installers into Gh0st RAT

The stages below come from Dragon Breath and APT-Q-27 activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

RONINGLOADER, Gh0st RAT and the signed driver

Initial Access

CVES EXPLOITED

Trojanized installers and sideloading over CVE exploitation

Dragon Breath mainly gains access through trojanized installers, DLL sideloading, BYOVD and certificate abuse rather than a consistent set of exploited software vulnerabilities, so this profile does not list a confirmed exploited-CVE set tied to the group. Some archive lures in our records reference WinRAR flaws (CVE-2025-8088, CVE-2025-6218). Detection should focus on the double-sideloading chain, RONINGLOADER and Gh0st RAT, and the signed kernel driver.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

RONINGLOADER, the DigiCert breach and a signed driver

Recent reporting tracks the group's tooling and certificate abuse.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through