New RoningLoader Campaign Uses DLL Side

Cybersecuritynews •Tushar Subhra Dutta • April 9, 2026

A threat actor known as DragonBreath has launched a stealthy campaign using a multi-stage malware loader called RoningLoader. The malware targets Chinese-speaking users by disguising itself as trusted software such as Google Chrome and Microsoft Teams. Its core strength lies in a layered approach to avoiding detection — combining DLL side-loading, code injection, and signed […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DragonBreath APT Launches RoningLoader Malware Campaign Targeting Chinese Users The DragonBreath group, also known as APT-Q-27, has initiated a new campaign utilizing RoningLoader malware, which employs advanced techniques such as DLL side-loading and code injection to evade security measures. This campaign primarily targets Chinese-speaking users by masquerading as legitimate applications like Google Chrome and Microsoft Teams. Active since at least 2022, DragonBreath has progressively enhanced its tactics, making detection increasingly difficult. The malware's multi-stage loader approach allows it to infiltrate systems without raising alarms. Reports indicate that the campaign has been linked to espionage activities, although specific numbers of affected users or systems have not been disclosed. The current status of the campaign suggests ongoing operations, with security firms monitoring its developments closely. 2 sources 67

Extracted Entities

New RoningLoader Campaign Uses DLL Side

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (3)

Tools (2)