# CylindricalCanine

> As of 2026-11-03, CylindricalCanine is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning apt, supply chain. ATT&CK coverage spans 59 techniques across 13 tactics in 2 of 2 tracked threats. Most-observed techniques: T1056.001 (Keylogging), T1057 (Process Discovery), T1113 (Screen Capture).

- **Tracked threats:** 2
- **Categories:** APT, SUPPLY_CHAIN
- **As of:** 2026-11-03

## ATT&CK techniques observed

59 techniques observed across 2 of 2 tracked threats. Tactics: Stealth (formerly Defense Evasion) (11), Command and Control (10), Initial Access (9), Persistence (6), Credential Access (4), Resource Development (4).

- [T1056.001](https://intel.threadlinqs.com/technique/T1056.001) Keylogging — Collection — observed in 2 of 2 tracked threats
- [T1057](https://intel.threadlinqs.com/technique/T1057) Process Discovery — Discovery — observed in 2 of 2 tracked threats
- [T1113](https://intel.threadlinqs.com/technique/T1113) Screen Capture — Collection — observed in 2 of 2 tracked threats
- [T1204.002](https://intel.threadlinqs.com/technique/T1204.002) Malicious File — Execution — observed in 2 of 2 tracked threats
- [T1553.002](https://intel.threadlinqs.com/technique/T1553.002) Code Signing — Defense Impairment — observed in 2 of 2 tracked threats
- [T1574.001](https://intel.threadlinqs.com/technique/T1574.001) DLL — Stealth (formerly Defense Evasion) — observed in 2 of 2 tracked threats
- [T1588.003](https://intel.threadlinqs.com/technique/T1588.003) Code Signing Certificates — Resource Development — observed in 2 of 2 tracked threats
- [T1685.005](https://intel.threadlinqs.com/technique/T1685.005) Clear Windows Event Logs — Defense Impairment — observed in 2 of 2 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1007](https://intel.threadlinqs.com/technique/T1007) System Service Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1014](https://intel.threadlinqs.com/technique/T1014) Rootkit — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1021.001](https://intel.threadlinqs.com/technique/T1021.001) Remote Desktop Protocol — Lateral Movement — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats

## Tracked threats

- [CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639](https://intel.threadlinqs.com/threat/TL-2026-5143) — HIGH
- [GoldenEyeDog / CylindricalCanine Breaches DigiCert Support System to Hijack EV Code-Signing Certificates for Golden Gh0st RAT and Zhong Stealer Distribution](https://intel.threadlinqs.com/threat/TL-2026-1579) — CRITICAL

## Related CVEs

1 CVE referenced by tracked CylindricalCanine activity.

- [CVE-2026-40639](https://intel.threadlinqs.com/cve/CVE-2026-40639)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/CylindricalCanine