GoldenEyeDog / CylindricalCanine Breaches DigiCert Support System to Hijack EV Code-Signing Certificates for Golden Gh0st RAT and Zhong Stealer Distribution

Key facts

Detection coverage

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1579 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SPL — Malicious .scr/Masqueraded Attachment Executed on Support/Helpdesk Endpoint

Detects execution of a screensaver (.scr) or double-extension file (e.g. newimage.pdf.scr, updat.log.exe) shortly after it was written to disk by a browser, chat client, or Salesforce/ticketing agent process — the GoldenEyeDog/CylindricalCanine initial-access vector used against DigiCert support staff (T1566.001, T1204.002, T1036.005).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1036.005
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image)
| where like(img, "%.scr") OR match(img, "(?i)\.(pdf|log|jpg|png)\.(exe|scr)$")
| eval parent=lower(ParentImage)
| where match(parent, "(?i)(chrome|msedge|firefox|outlook|teams|salesforce|slack)\.exe")
| table _time, ComputerName, User, Image, ParentImage, CommandLine, Hashes
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (".scr") or FolderPath matches regex @"(?i)\.(pdf|log|jpg|png)\.(exe|scr)$"
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","outlook.exe","teams.exe","slack.exe")
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, InitiatingProcessFileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Screensaver or Double-Extension File Executed From Browser/Chat Client
id: 7c1a4e2d-6b3f-4a91-9d0e-1f2b3c4d5e6a
status: experimental
description: Detects execution of a .scr file or a double-extension file (e.g. newimage.pdf.scr) spawned by a browser, chat, or ticketing-agent process, matching the GoldenEyeDog support-portal lure delivery method used against DigiCert.
references:
    - https://expel.com/blog/introducing-cylindricalcanine/
    - https://cybersecuritynews.com/goldeneyedog-behind-digicert-breach/
author: Threadlinqs Team
date: 2026-07-20
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.golden_gh0st
logsource:
    product: windows
    category: process_creation
detection:
    selection_ext:
        Image|endswith: '.scr'
    selection_double_ext:
        Image|re: '(?i)\.(pdf|log|jpg|png)\.(exe|scr)$'
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\outlook.exe'
            - '\teams.exe'
            - '\slack.exe'
    condition: (selection_ext or selection_double_ext) and selection_parent
falsepositives:
    - Legitimate screensaver installers downloaded and run intentionally by users
    - Marketing/PDF-viewer bundles that legitimately ship self-extracting .scr helpers (rare)
level: high

Known false positives:

• Legitimate .scr screensaver installers manually downloaded and executed by a user

Tuning notes: Scope to support/helpdesk/CS-adjacent OU or asset tag first to control volume; add filename allow-list for known internal screensaver deployment tooling before enabling org-wide.

• 🔒 KQL — Support/Helpdesk Endpoint Ingests and Opens Trojanized Support-Ticket Attachment · unlock with TL Creds
• 🔒 KQL — Scheduled Task Creation Followed by New Local Administrator Account (Golden Gh0st Persistence Pair) · unlock with TL Creds
• 🔒 KQL — Windows Security Event Log Cleared on Recently-Compromised Endpoint (Anti-Forensics) · unlock with TL Creds
• 🔒 Sigma — EV Code-Signed Binary With No Prior Reputation Loads Unsigned DLL (Certificate Abuse Pattern) · unlock with TL Creds
• 🔒 Sigma — Golden Gh0st RAT Credential/Screenshot/Keylog Collection Burst Post-Sideload · unlock with TL Creds
• 🔒 Sigma — Cloud-Storage-Hosted Payload Download Immediately Preceding Signed-Binary Execution (Aliyun OSS HK / GCS) · unlock with TL Creds
• 🔒 SPL — Golden Gh0st DLL Sideload via down.exe / TASLogin Host Binary · unlock with TL Creds
• 🔒 SPL — Golden Gh0st RAT WebSocket C2 Beacon on Ports 5188/5198 · unlock with TL Creds

Indicators of compromise

As of 2026-09-14, Threadlinqs Intelligence tracks 35 indicators of compromise for TL-2026-1579.

Sample indicators (3 of 35)

• IP address: 82.23.186[.]8
• Domain: uu[.]goldeyeuu[.]io
• File hash: 4eaebd93e23be3427d4c1349d64bef4b5fc455c93aebb9b5b752981e9266488e

Defanged, TLP:CLEAR. Full set of 35 indicators: unlock with TL Creds.

Technical analysis

The attackers used the stolen codes to obtain legitimate DigiCert EV code-signing certificates, which they used to sign Golden Gh0st Loader, Golden Gh0st RAT, and Zhong Stealer malware, enabling DLL sideloading attacks that bypass Windows code-signing trust controls.

In April 2026, a threat actor contacted DigiCert's customer support through a chat/ticketing channel and submitted a malicious archive disguised as a customer screenshot. The payload was a Windows .scr screensaver-format executable, a technique the group has used historically to bypass filename-based scrutiny. A DigiCert support employee executed the file, infecting the endpoint on April 2; DigiCert identified the compromise of a first endpoint on April 3 and a second, related endpoint on April 14 -- the delayed detection attributed to malfunctioning endpoint security software. From the compromised support endpoints, the attacker abused a support-analyst capability that allows proxying into customer accounts to access initialization codes tied to code-signing certificate renewal orders. DigiCert's own process treats possession of a valid initialization code plus an approved underlying order as sufficient to retrieve the resulting certificate -- no additional identity verification is required at that step. Using this weakness, the attacker generated legitimate EV Code Signing certificates across multiple customer accounts without the customers' knowledge, effectively laundering malware through a trusted certificate authority.

DigiCert revoked 60 code-signing certificates by April 17, 2026 in response, including 27 explicitly linked to the intruder's activity. Of those 27, 11 were identified after external security researchers submitted certificate problem reports (CPRs) tying the certificates to malware samples signed with them, and 16 were found through DigiCert's internal investigation. Community researchers subsequently confirmed that certificates from this batch had been used to sign samples of the Zhong Stealer malware family, an information-stealer with prior links to Chinese e-crime activity and cryptocurrency theft. DigiCert canceled all pending orders tied to the compromised accounts and implemented remediation including mandatory MFA for administrative support workflows, blocking proxy access to initialization codes for support staff, restricting file types accepted via chat/Salesforce case attachments, and improving support-system logging.

Security researchers at Expel subsequently attributed the operational tradecraft behind the DigiCert intrusion to a cluster they track as CylindricalCanine, assessed as a subgroup of the broader GoldenEyeDog ecosystem -- also referenced in industry reporting under the aliases APT-Q-27, Dragon Breath, and Miuuti Group. GoldenEyeDog is a Chinese cybercrime group historically associated with targeting the online gambling and gaming sectors via trojanized/counterfeit software downloads. The group's toolkit centers on the Golden Gh0st malware family: Golden Gh0st Loader (a DLL-sideloading first-stage loader active since at least 2015), Golden Gh0st RAT (a heavily modified fork of the public Gh0st RAT codebase providing remote command execution, keylogging, screenshot capture, process/service discovery, browser credential theft, proxy tunneling, file deletion, and Windows event-log clearing capability), and Zhong Stealer (a separate information-stealer family used for financially motivated cryptocurrency and credential theft, distributed here using the same stolen-certificate infrastructure).

Post-DigiCert-breach delivery infrastructure observed by researchers includes trojanized files masquerading as images, PDFs, and log files (e.g. newimage.pdf, updat.log, TASLogin.log) staged on Aliyun OSS (Hong Kong region) and, in a June 2026 follow-on wave, Google Cloud Storage buckets. Golden Gh0st RAT's DLL-sideloading component (TASLoginBase.dll / crashreport.dll, loaded by a legitimate-looking host binary such as down.exe or TASLogin) establishes persistence via scheduled tasks and newly created local administrator/backdoor accounts, then beacons to attacker-controlled infrastructure over unencrypted WebSocket connections on non-standard low ports (5188 and 5198) carrying AES-style encrypted payload content secured with a hardcoded REGISTERKEY/MODULEKEY pair, a technique that evades TLS-inspection-oriented network monitoring while still concealing payload contents at the application layer. The technique of signing this loader/RAT/stealer chain with legitimately issued, stolen-initialization-code EV certificates is the campaign's most consequential innovation: Windows SmartScreen and many endpoint security products grant elevated trust and reduced scrutiny to EV-signed binaries, and Microsoft Defender reportedly generated widespread false-positive detections against legitimately signed software in the aftermath as vendors and defenders scrambled to blocklist the abused certificate serials.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture

Discovery

T1007 System Service Discovery; T1057 Process Discovery; T1087 Account Discovery

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1562.001 Impair Defenses: Disable or Modify Tools; T1574 Hijack Execution Flow

Persistence

T1053.005 Scheduled Task; T1136.001 Local Account; T1505 Server Software Component; T1543.003 Create or Modify System Process: Windows Service; T1574.002 Hijack Execution Flow: DLL Side-Loading

Credential Access

T1056 Input Capture; T1056.001 Keylogging; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers

Execution

T1059.003 Windows Command Shell; T1204 User Execution; T1204.002 Malicious File

Command and Control

T1071 Application Layer Protocol; T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel; T1573.001 Symmetric Cryptography

Privilege Escalation

T1078 Valid Accounts; T1078.003 Local Accounts; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Initial Access

T1195 Supply Chain Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

defense-impairment

T1553.002 Code Signing; T1685.005 Clear Windows Event Logs

Impact

T1565 Data Manipulation

stealth

T1574.001 DLL

Resource Development

T1583 Acquire Infrastructure; T1583.006 Web Services; T1588 Obtain Capabilities; T1588.003 Code Signing Certificates

Remediation

Immediate actions

• Revoke trust for and blocklist all DigiCert EV code-signing certificate serials disclosed as compromised (60 revoked by DigiCert as of 2026-04-17, 27 explicitly attacker-linked)
• Hunt for outbound WebSocket connections to TCP ports 5188 and 5198, particularly to uu.goldeyeuu.io, wk.goldeyeuu.io, and api.keensie.com
• Block/alert on downloads from kkuu.oss-cn-hongkong.aliyuncs.com and the storage.googleapis.com/kiki001/ Google Cloud Storage path
• Search endpoints for the disclosed file hashes (down.exe, TASLoginBase.dll, TASLogin.log, crashreport.dll, updat.log, newimage.pdf, plugin32.dll, and the Golden Gh0st RAT sample)
• Audit newly created local administrator accounts and scheduled tasks created since April 2026 on internet-facing or support-adjacent endpoints

Workarounds

• Manually blocklist the disclosed C2 domains (goldeyeuu.io, keensie.com) and hosting paths at DNS/proxy layer pending full certificate-revocation propagation

Longer-term hardening

• Deploy EDR/behavioral detection tuned to DLL sideloading by legitimate-looking host binaries
• Implement code-signing certificate transparency monitoring / certificate problem report ingestion to catch abuse of legitimately issued certificates
• Restrict acceptable file types on customer support/chat and ticketing intake channels; sandbox-detonate all support-channel attachments before any human opens them
• Enforce MFA on all support/administrative workflows capable of accessing customer certificate initialization codes
• Remove or tightly scope support-analyst 'proxy into customer account' capabilities; require secondary approval for initialization-code retrieval

Affected and fixed versions

• DigiCert — EV Code Signing Certificate issuance / support ticketing platform
  Vulnerable versions: support ticketing/chat system, pre-April 2026 initialization-code access controls
  Fixed in: post-2026-04-17 remediation: MFA enforcement, restricted proxy access to initialization codes, restricted chat/Salesforce attachment file types
• Microsoft — Windows (SmartScreen / code-signing trust validation)
  Vulnerable versions: all supported Windows versions relying on Authenticode EV certificate trust
  Fixed in: N/A - mitigated via certificate revocation, not a Windows patch

Timeline

Last updated 2026-09-14 · revalidated 1× · latest source

• 2015-01-01 Golden Gh0st Loader first observed as an active DLL-sideloading tool in the wild, predating the DigiCert campaign by roughly a decade.
• 2024-01-01 GoldenEyeDog begins abusing code-signing certificates to bypass Windows SmartScreen; AnyRun documents associated Zhong Stealer payloads.
• 2024-12-01 Earlier GoldenEyeDog campaign phase observed using a first-stage executable delivery chain, preceding the DigiCert-certificate-enabled campaign.
• 2025-11-01 Elastic Security Labs publishes analysis of RONINGLOADER, a multi-stage NSIS-based loader used by the related Dragon Breath/GoldenEyeDog cluster to abuse a signed driver for PPL-based Defender disablement and deploy a modified Gh0st RAT.
• 2026-01-01 Updated RONINGLOADER samples masquerading as Chrome/Teams NSIS installers are identified, continuing the Dragon Breath campaign.
• 2026-04-02 Attacker delivers a malicious .scr file disguised as a customer screenshot through DigiCert's support chat/ticketing channel; a support employee executes it, infecting the endpoint.
• 2026-04-03 DigiCert identifies compromise of the first infected support endpoint.
• 2026-04-04 The second DigiCert support-analyst endpoint is compromised (distinct from its April 14 detection date already on record); the intrusion on this endpoint went undetected for roughly two weeks.
• 2026-04-12 A Golden Gh0st RAT implant sample tied to the intrusion is observed/compiled.
• 2026-04-14 DigiCert identifies a second, related infected endpoint; delayed detection attributed to malfunctioning endpoint security software.
• 2026-04-17 DigiCert revokes 60 code-signing certificates (27 explicitly linked to the attacker) and cancels all pending orders tied to compromised accounts, closing the attacker's access.
• 2026-05-04 DigiCert breach and screensaver-malware delivery method first publicly reported by SecurityWeek and Help Net Security.
• 2026-05-05 Security researchers confirm stolen EV code-signing certificates were used to sign Zhong Stealer malware samples.
• 2026-05-07 Black Swan Cybersecurity publishes a threat advisory on the DigiCert compromise detailing attacker IPs, malware hashes, and remediation guidance.
• 2026-05-10 Microsoft Defender false-positive wave reported across legitimately signed software as vendors blocklist abused certificate serials in response to the breach.
• 2026-06-01 Follow-on campaign wave observed using Google Cloud Storage (locked-ioc-15) for payload hosting, alongside continued use of Aliyun OSS Hong Kong infrastructure.
• 2026-07-16 Expel publishes research attributing the DigiCert-incident tradecraft to a cluster it tracks as CylindricalCanine, a subgroup of GoldenEyeDog (aka APT-Q-27 / Dragon Breath / Miuuti Group).
• 2026-07-17 The Hacker News, Cyber Security News, GBHackers, and Cyberpress publish consolidated coverage naming GoldenEyeDog/CylindricalCanine as responsible for the DigiCert breach and certificate-hijacking campaign.
• 2026-07-19 The CTO at NCSC weekly summary digest includes coverage of the DigiCert compromise and certificate theft.

Update history

• 2026-09-14 — GoldenEyeDog Subgroup CylindricalCanine Breaches DigiCert, Hijacks Code-Signing Certificates to Sign Malware: What changed Attribution confidence MEDIUM → HIGH, corroborated by Expel's formal CylindricalCanine attribution and an independent Black Swan Cybersecurity advisory identifying 7 attacker-controlled IPs.

Sources cited

• Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident expel.com · Research · 2026-07-16
• DigiCert compromise precedes widespread Microsoft Defender false positives threatlocker.com · Blog · 2026-05-10
• GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates cybersecuritynews.com · News · 2026-07-17
• GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft The Hacker News · News · 2026-07-17
• DigiCert Revokes Certificates After Support Portal Hack SecurityWeek · News · 2026-05-04
• DigiCert breached via malicious screensaver file Help Net Security · News · 2026-05-04
• DigiCert Support Portal Hacked: Stolen EV Certificates Used to Sign Zhong Stealer Malware cipherssecurity.com · News · 2026-05-05
• DigiCert suffers breach, stolen certificates used to sign malware cyberinsider.com · News · 2026-05-04
• DigiCert Security Breach Linked to GoldenEyeDog Certificate Hijacking Campaign cyberpress.org · News · 2026-07-17
• GoldenEyeDog Threat Group Behind DigiCert Code-Signing Certificate Attack gbhackers.com · News · 2026-07-17

Related threats

• Dragon Breath (APT-Q-27) Deploys RONINGLOADER to Disable Security Tools and Drop Gh0st RAT

More from DragonBreath

• CTO at NCSC Weekly Summary (week ending July 19, 2026): Russian FSB Center 16 router exploitation, Turla, Daxin/Stupig, GoldenEyeDog DigiCert compromise, CVE-2026-40639

Previous and next in supply chain

• CodeTracer: Forensic Attribution Tool for Backdoored AI Code-Completion Models Previous report
• Executive Order 14415: Trump Administration Tightens Defense Supply Chain Oversight, Mandates Domestic Sourcing of Critical Materials Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages