AttackIQ Releases RoningLoader Emulation for DragonBreath Behaviors
Summary
AttackIQ added a RoningLoader emulation to its AEV platform, modeling DragonBreath (APT-Q-27) post-compromise behaviors across execution, persistence, privilege escalation, defense evasion and discovery to help organizations test security controls.
Key points
- The article describes DragonBreath (APT-Q-27) as distributing a modified gh0st RAT and targeting Chinese-speaking users, including users of cryptocurrency-related software and gaming VPN tools.
- AttackIQ’s RoningLoader – 2025-11 emulation models post-compromise behaviors attributed to DragonBreath and documented by Elastic Security Labs in November 2025.
- Execution and persistence scenarios include service execution using StartServiceA or sc.exe and creating a demand-start Windows service with CreateServiceA.
- Other scenarios simulate SeDebugPrivilege and token inspection, DLL injection and side-loading, disabling UAC, executing a DLL through RegSvr32, and native-API process discovery.
- AttackIQ says organizations can use the emulation to continuously assess detection and prevention controls and security response processes; the article does not report independent testing of those outcomes.
Article Details
- Event Type
- AttackIQ released a RoningLoader threat emulation in its Adversarial Exposure Validation platform.
- Impact
- The emulation reproduces post-compromise behaviors attributed to DragonBreath to help organizations assess security controls and detection and prevention pipelines. The article says DragonBreath distributes a modified gh0st RAT and targets Chinese-speaking users, particularly users of cryptocurrency-related software and gaming VPN tools.
MITRE ATT&CK
T1055.001 · Dynamic-link Library InjectionThe emulation includes DLL injection using CreateRemoteThread and LoadLibrary, a behavior associated with DragonBreath's post-compromise activity.T1057 · Process DiscoveryThe emulation includes enumerating running processes using native APIs, a behavior associated with DragonBreath's post-compromise activity.T1134 · Access Token ManipulationThe emulation includes enabling SeDebugPrivilege and inspecting access-token information, behaviors associated with DragonBreath's post-compromise activity.T1218.010 · Regsvr32The emulation includes executing a DLL through RegSvr32, a behavior associated with DragonBreath's post-compromise activity.T1543.003 · Windows ServiceThe emulation includes creating a Windows service with CreateServiceA for persistence, a behavior associated with DragonBreath's post-compromise activity.T1548.002 · Bypass User Account ControlThe emulation includes disabling User Account Control through the registry, a behavior associated with DragonBreath's post-compromise activity.T1569.002 · Service ExecutionAttackIQ's emulation includes service execution using StartServiceA and sc.exe, behaviors associated in the article with DragonBreath's post-compromise activity.T1574.002 · DLL Side-LoadingThe emulation includes DLL side-loading using a trusted executable to load a malicious DLL, a behavior associated with DragonBreath's post-compromise activity.
Threat Actors
Malware
Gh0st RATevolving threat actor targeting Chinese-speaking users with a modified variant of the open-source gh0st RAT and has focused on cryptocurrency-related and gaming VPN software since at least 2022.RoningLoaderAttackIQ published a RoningLoader emulation in its AEV platform to reproduce the group’s post-compromise TTPs and help organizations validate detection, prevention, and continuous testing of security controls.