Do Son Elastic exposed Dragon Breath APT's new RoningLoader malware. It uses PPL abuse and a signed kernel driver (ollama.sys) to disable Windows Defender and inject a modified gh0st RAT for espionage.
Protected Process Light
Learn about the latest developments in bypassing LSASS protection and the vulnerabilities that still exist within the system.