DragonBreath: Dragon in the Kernel

**Executive summary:** This advisory documents a critical zero‑day BYOVD vulnerability in the WHQL‑signed kernel driver dragoncore_k.sys (Zhengzhou 403), which exposes an unauthenticated IOCTL allowing Ring‑0 termination of processes (bypassing PPL/HVCI and neutralizing EDR/AV); associated signed droppers, shared CobaltStrike C2 (oss-aws.1nb.xyz), revoked EV certificate evidence, extensive IoCs, and attribution to Dragon Breath APT (APT‑Q‑27) with a medium‑confidence personnel link to APT31 are provided alongside mitigation and disclosure guidance.