DragonBreath: Dragon in the Kernel

**Executive Summary:** This advisory documents a critical zero-day BYOVD vulnerability in a WHQL-signed kernel driver (dragoncore_k.sys) issued to Zhengzhou 403 Network Technology Co., Ltd.; the driver exposes an unauthenticated IOCTL enabling Ring-0 termination of PPL-protected processes, fully neutralizing endpoint security. The report provides technical reverse engineering, exploitation chain, YARA detection, IOCs (file hashes, EV cert serial 4668EDFA623554CF0B48F401, C2 domain oss-aws.1nb.xyz), links to malicious droppers and MalwareBazaar samples, and attributes the activity with high confidence to Dragon Breath APT (APT-Q-27) while noting a medium-confidence personnel nexus to APT31/Wuhan Xiaoruizhi.