RoningLoader Campaign Uses DLL Side-Loading, Code Injection to Slip Past Defenses

Gbhackers •Mayura Kathir • April 9, 2026

A sophisticated cyber-espionage group known as DragonBreath (APT-Q-27) has been linked to a new RoningLoader malware campaign that uses advanced evasion techniques such as DLL side-loading and code injection to bypass traditional security defenses. Active since at least 2022, DragonBreath has steadily evolved its capabilities. Earlier campaigns were documented by QianXin and Sophos, but recent […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DragonBreath APT Launches RoningLoader Malware Campaign Targeting Chinese Users The DragonBreath group, also known as APT-Q-27, has initiated a new campaign utilizing RoningLoader malware, which employs advanced techniques such as DLL side-loading and code injection to evade security measures. This campaign primarily targets Chinese-speaking users by masquerading as legitimate applications like Google Chrome and Microsoft Teams. Active since at least 2022, DragonBreath has progressively enhanced its tactics, making detection increasingly difficult. The malware's multi-stage loader approach allows it to infiltrate systems without raising alarms. Reports indicate that the campaign has been linked to espionage activities, although specific numbers of affected users or systems have not been disclosed. The current status of the campaign suggests ongoing operations, with security firms monitoring its developments closely. 2 sources 67

Extracted Entities

RoningLoader Campaign Uses DLL Side-Loading, Code Injection to Slip Past Defenses

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (2)