RoningLoader Campaign Uses DLL Side-Loading, Code Injection to Slip Past Defenses

**Executive Summary:** DragonBreath (APT-Q-27) is operating a RoningLoader campaign that deploys a customized Gh0st RAT and uses DLL side-loading, CreateRemoteThread/LoadLibrary injection, service creation/abuse, privilege escalation, UAC disabling, and living‑off‑the‑land tools to maintain stealth and persistence while targeting Chinese-speaking users—particularly cryptocurrency apps and gaming VPNs; AttackIQ published an attack graph to help organizations validate defenses against these techniques.