New RoningLoader Campaign Uses DLL Side-Loading and Code Injection to Evade Detection

RoningLoader is a multi-stage, technically sophisticated loader used by APT DragonBreath to target Chinese-speaking users across East and Southeast Asia; it abuses trojanized NSIS installers, DLL side‑loading, in-memory payloads, and a signed kernel driver to disable multiple security products and ultimately deploy a modified gh0st RAT for espionage and data theft.