GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

1. Executive summary

In April 2026, a threat cluster dubbed "CylindricalCanine" — described by Expel as a subgroup of the Chinese cybercrime actor GoldenEyeDog (aka APT-Q-27, Dragon Breath, Miuuti Group) — compromised two DigiCert support analyst workstations via a malicious payload delivered through a customer chat channel. The actor abused a support-portal impersonation function to steal initialization codes for approved-but-pending EV Code Signing certificate orders, using them to fraudulently obtain and sign malware with 60 certificates across four CAs. Attribution to GoldenEyeDog is unconfirmed: none of the named actors (GoldenEyeDog, CylindricalCanine, APT-Q-27, Dragon Breath, Miuuti Group) possess a MITRE ATT&CK profile in the verified reference data. EMEA financial services clients face risk from malware signed with these fraudulently obtained certificates until certificate trust is revoked and endpoint validation is enforced.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 28: ICT third-party risk — general principles	DigiCert, a certificate authority and ICT third-party provider to many financial institutions, suffered a breach enabling fraudulent issuance of code-signing certificates that could be used to sign malware targeting client environments.	Clients must assess whether their code-signing certificates were among the compromised set and review third-party risk exposure to DigiCert as a CA provider.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If a client's EV Code Signing certificate was fraudulently obtained and used to sign malware, this constitutes a major ICT-related incident with potential systemic trust implications.	Clients whose certificates were among the 60 revoked must evaluate whether this meets their major-incident classification threshold and report accordingly.

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by Expel and DigiCert disclosures)

Initial contact (2026-04-02): A threat actor contacted DigiCert's support team via a customer chat channel and delivered a ZIP file disguised as a customer screenshot.
Payload execution: The ZIP contained a .scr executable with a malicious payload. A DigiCert support analyst executed the payload, infecting their workstation.
Workstation compromise: The actor gained access to two DigiCert support analyst workstations. The malware used is attributed to GoldenEyeDog's tooling — a modified Gh0st RAT variant referred to as "Golden Gh0st RAT," delivered via "Golden Gh0st Loader."
Portal abuse: Using the compromised analyst's authenticated session, the actor accessed a limited function within DigiCert's customer-support portal that allows support staff to impersonate customers (view the customer's perspective) to facilitate support tasks.
Certificate theft: The actor used this impersonation function to access initialization codes for orders that were approved but pending delivery — specifically for EV Code Signing certificate orders across a finite set of customer accounts.
Fraudulent issuance: Possession of an initialization code coupled with an approved order was "functionally sufficient" to obtain EV Code Signing certificates. The actor obtained certificates from four CAs: - DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1 - DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 - GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1 - Verokey High Assurance Secure Code EV
Malware signing: The fraudulently obtained certificates were used to sign the actor's own malware to evade detection. DigiCert revoked 60 certificates; 27 are said to have been [used/recovered — source text truncates at this point].

Malware ecosystem context (single-sourced to Expel/Elastic Security Labs; verify before enforcement)

Golden Gh0st RAT: A modified variant of Gh0st RAT (aka Farfli), modular, used by GoldenEyeDog. Behavioral and tactical overlaps with a payload documented by QiAnXin in 2020 (gambling industry targeting since 2019) and with malware documented by ANY.RUN in February 2025 as "Zhong Stealer."
Golden Gh0st Loader: The loader component used to deliver Golden Gh0st RAT.
RONINGLOADER: A multi-stage loader detailed by Elastic Security Labs (November 2025 report) used to distribute a Gh0st RAT variant through NSIS installers masquerading as legitimate programs including Google Chrome and Microsoft Teams.
Delivery patterns: Counterfeit websites pushing malware-laced software; customer support chat channels used to deliver malicious links/files (observed in a campaign targeting Web3 company support staff).
Targeting: Gambling/gaming sectors historically; finance organizations in the Asia-Pacific region per Expel.

Attribution caveat: The attribution to GoldenEyeDog/CylindricalCanine rests on Expel's analysis. None of the named actors — GoldenEyeDog, CylindricalCanine, APT-Q-27, Dragon Breath, Miuuti Group — have a MITRE ATT&CK profile in the verified reference data. Treat all actor naming as unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

Audit certificate trust stores for any certificates issued by the four named CAs (DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1, DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, Verokey High Assurance Secure Code EV). DigiCert has revoked 60 certificates; verify your endpoint trust stores have absorbed the CRL/OCSP updates.
Block execution of .scr files received via chat, email, or other communication channels using application control / EDR policies. The initial access vector was a .scr executable inside a ZIP.
Review DigiCert account posture: If your organisation holds EV Code Signing certificates issued by DigiCert, confirm whether your certificates were among the compromised set. Contact DigiCert support for the list of affected customer accounts.
Validate code-signing certificate provenance on recently deployed or in-deployment software: any binary signed after 2026-04-02 with a certificate from the four named CAs should be treated as suspicious until verified against the legitimate publisher.

P2 — Within 72 hours

Enforce strict code-signing validation on endpoints: ensure SmartScreen, AppLocker, or equivalent policies are configured to block binaries signed with revoked or untrusted certificates. Confirm CRL and OCSP stapling is functioning.
Hunt for Golden Gh0st RAT / RONINGLOADER indicators: Search endpoint telemetry for NSIS installer activity masquerading as Google Chrome or Microsoft Teams updates, and for Gh0st RAT network beaconing patterns. (No atomic IOCs are available in the source material — see §5.)
Review customer support chat workflows: If your organisation operates customer support channels that accept file uploads, enforce sandboxing/CDR (content disarm and reconstruction) on all inbound files. Isolate support analyst workstations from internal certificate management infrastructure.

P3 — Within 7 days

Assess third-party risk: Under DORA Art. 28, evaluate DigiCert as an ICT third-party provider in light of this incident. Determine whether contractual provisions (DORA Art. 30) require incident notification from DigiCert and whether concentration risk (DORA Art. 29) is material if DigiCert is your sole or primary CA.
Implement mandatory out-of-band verification for certificate initialization code retrieval and EV Code Signing issuance workflows if your organisation operates similar customer-impersonation support functions.

5. Indicators of compromise

No atomic indicators of compromise (hashes, IPs, domains) are available in the source material. The sources describe observable behaviours and artefact names but no machine-pivotable IOCs.

Behavioural indicators

Behaviour	Where to observe	Confidence
`.scr` executable delivered inside a ZIP file via customer support chat	Email/chat gateway logs, endpoint file-write events, EDR	High — confirmed by DigiCert disclosure
NSIS installer masquerading as Google Chrome or Microsoft Teams	Endpoint process execution telemetry, file system (Program Files / Temp), EDR	Medium — single-sourced to Elastic Security Labs (Nov 2025)
Support portal impersonation function accessed from compromised analyst session	DigiCert support portal audit logs (DigiCert-side); client-side: unusual certificate issuance activity	High — confirmed by DigiCert disclosure
Binary signed with certificates from the four named CAs after 2026-04-02	Code-signing validation logs, EDR, certificate transparency logs	High — confirmed; 60 certificates revoked

6. Detection

Insufficient atomic indicators to author YARA or Sigma rules. The source material names malware families (Golden Gh0st RAT, Golden Gh0st Loader, RONINGLOADER, Zhong Stealer) and delivery artefacts (NSIS installers masquerading as Google Chrome / Microsoft Teams, .scr files inside ZIP archives) but provides no hard-coded strings, mutex names, registry keys, specific file paths, command-line flags, or network signatures from which to build detection rules without fabricating content.

Recommended detection approach based on available behavioural detail

Sigma rule for .scr execution from ZIP archives delivered via chat applications (process creation of *.scr from temp/user directories).
EDR hunting query for NSIS installer processes spawning from files named chrome_setup.exe, Teams_setup.exe, or similar legitimate-software-impersonating names in non-standard directories.
Certificate transparency log monitoring for certificates issued by the four named CAs to your organisation's identity that were not requested through your internal procurement workflow.

7. Sources

The Hacker News, "GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft," https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html, 2026-07-17
Expel (Aaron Walton), technical analysis of CylindricalCanine/DigiCert incident — referenced via The Hacker News article above
Elastic Security Labs, report on RONINGLOADER and Gh0st RAT distribution via NSIS installers, November 2025 — referenced via The Hacker News article above
DigiCert, security incident disclosure (April 2026) — referenced via The Hacker News article above
QiAnXin, 2020 report on gambling-industry attack campaign — referenced via The Hacker News article above
ANY.RUN, February 2025 documentation of "Zhong Stealer" — referenced via The Hacker News article above

8. Adverse Trace position

This is a high-severity supply-chain compromise with direct implications for EMEA financial services. The theft of EV Code Signing certificates from a major CA enables the actor to sign malware that will pass default trust validation on Windows endpoints — a meaningful escalation for any organisation that relies on code-signing as a trust boundary. The attack chain is socially simple (chat-delivered .scr file) but the downstream impact (trusted malware) is significant. Attribution to GoldenEyeDog/CylindricalCanine is unconfirmed — no MITRE ATT&CK profiles exist for any of the named actors in the verified reference data, and the attribution rests on Expel's single-sourced analysis. We are treating this as a confirmed DigiCert breach with unconfirmed actor attribution. Adverse Trace will monitor for: (a) publication of the 60 revoked certificate serial numbers for client blocking, (b) any IOCs from Expel's full technical report, and (c) evidence of signed malware appearing in the wild targeting EMEA financial sector organisations. Clients should immediately audit their DigiCert certificate inventory and enforce CRL/OCSP updates across all endpoints.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.