A newly discovered threat organization has surfaced in the landscape and is targeting gambling companies with various cyberattacks. The group is tracked under many names including Dragon Breath, Golden Eye Dog, or APT-Q-27 and has targeted several entities throughout China, the Philippines, Singapore, Hong Kong, Japan, and Taiwan. Primarily focused on exploiting gambling companies, Dragon Breath has utilized dynamic link library (DLL) sideloading attacks with a new twist. Typically, attacks identified in the landscape involve the standard sideloading attack with an application and malicious loader/payload. The twist Dragon Breath actors implemented adds a second clean application in the first stage of the attack, auto executing the malicious loader once deployed on its target. Applications that were seen forged in this campaign include WhatsApp, Telegram, and LetsVPN installers which were laced with first-stage malware. Once all loaders are installed on the system, the malicious code will clear any system event logs, copy all clipboard data, execute arbitrary commands, and in some cases harvest cryptocurrency from the victim’s device. CTIX continues to monitor threat actor activity globally and will provide additional updates accordingly.