As cited
Copy frozen at (site build).
threat intel
RONINGLOADER: DragonBreath’s New Path to PPL Abuse
Elastic Security Labs identified RONINGLOADER, a multi-stage loader tied to DragonBreath that deploys an updated gh0st remote access trojan (RAT) variant. The malware uses signed drivers, thread-pool injection, and Privileged Process Light (PPL) abuse to disable Windows Defender and evade Chinese endpoint detection and response (EDR) tools.
Why it matters: Organizations in or targeted by Chinese threat actors need to assess whether their detection tooling and driver-signing processes can spot this technique, and whether PPL-aware defenses are in place.
- Source published
- First seen by Cybersecurity Tracker