Do Son Elastic exposed Dragon Breath APT's new RoningLoader malware. It uses PPL abuse and a signed kernel driver (ollama.sys) to disable Windows Defender and inject a modified gh0st RAT for espionage.
Kernel Driver
A flaw in the OpenVPN Windows kernel driver allows unprivileged local users to crash systems (BSOD) via oversized control packets. Update to 2.6.14-I002.