RONINGLOADER Weaponizes Signed Drivers to Disable Defender and Evade EDR Tools

Du'aine Davis

Observed in the wild

• On 15 November, Elastic Security Labs identified a new DragonBreath APT (APT-Q-27) campaign in late 2025 using a loader named RONINGLOADER. It delivers an updated gh0st RAT variant via trojanised NSIS installers masquerading as legitimate apps (e.g., Google Chrome, Microsoft Teams). The campaign primarily targets Chinese-speaking users and aggressively disables endpoint security, including Microsoft Defender, through advanced evasion techniques.
• The infection chain uses multi-stage delivery with signed kernel drivers, WDAC policy tampering, and Protected Process Light (PPL) abuse. It kills AV processes via driver IOCTL calls, injects shellcode using thread pools, and side-loads phantom DLLs. The malware elevates privileges, bypasses UAC, and injects payloads into trusted processes .
• Organisations should monitor for ClipUp.exe execution with -ppl parameters, suspicious WDAC policy changes, and remote memory writes to trusted processes.

RONINGLOADER: DragonBreath’s New Path to PPL Abuse — Elastic Security Labs