DragonBreath

Reports per quarter

Techniques seen in the last two years

• T1014 1 report
• T1055.009 1 report
• T1057 1 report
• T1068 1 report
• T1195.001 1 report
• T1497 1 report
• T1518.001 1 report
• T1543.003 1 report
• T1564.010 1 report
• T1588.002 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2024-4577 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 15 July 2026

   Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

2. 22 April 2026

   DragonBreath: Dragon in the Kernel

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor DragonBreath: Dragon in the Kernel

3. 6 April 2026

   Ghost RAT (Malware Family)

   date ORKL added it fromORKL

   The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Ghost RAT (Malware Family)

4. 15 November 2025

   RONINGLOADER: DragonBreath’s New Path to PPL Abuse

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor RONINGLOADER: DragonBreath’s New Path to PPL Abuse

5. 3 September 2024

   Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Toneshell Backdoor Used to Target Attendees of the IISS Defence Summit

Newest first. Details opens the report in Explore.