GoldenEyeDog / CylindricalCanine Breaches DigiCert Support System to Hijack EV Code-Signing Certificates for Golden Gh0st RAT and Zhong Stealer Distribution
GoldenEyeDog / CylindricalCanine Breaches DigiCert Support (TL-2026-1579), also tracked as DigiCert Support Portal Breach, is a critical-severity supply-chain compromise, first published 2026-07-20 and last reviewed 2026-09-14. It is attributed to DragonBreath (China) with high confidence, affects DigiCert EV Code Signing Certificate issuance / support ticketing, maps to 51 MITRE ATT&CK techniques (T1005, T1007, T1021.001), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-1579
- Threat ID
- TL-2026-1579
- Also known as
- DigiCert Support Portal Breach, GoldenEyeDog Certificate Hijacking Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-20
- Last reviewed
- 2026-09-14
- Attribution
- DragonBreath
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- technology, certificate-authority, software-supply-chain, gambling, gaming, finance
- Target regions
- Global, North America, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 35
- Updates
- 2026-09-14 · revalidated 1× · latest source
Malware and tooling in GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
Malware and tooling: Golden Gh0st Loader, Golden Gh0st RAT, Zhong Stealer
Chinese cybercrime group GoldenEyeDog (via subgroup CylindricalCanine) compromised DigiCert's customer support ticketing/chat system in April 2026 by delivering a malicious file disguised as a screenshot, infecting two support endpoints and stealing initialization codes used to activate customer EV code-signing certificate renewals. The attackers used the stolen codes to obtain legitimate DigiCert EV code-signing certificates, which they used to sign Golden Gh0st Loader, Golden Gh0st RAT, and Zhong Stealer malware, enabling DLL sideloading attacks that bypass Windows code-signing trust controls.
How GoldenEyeDog / CylindricalCanine Breaches DigiCert Support works
In April 2026, a threat actor contacted DigiCert's customer support through a chat/ticketing channel and submitted a malicious archive disguised as a customer screenshot. The payload was a Windows .scr screensaver-format executable, a technique the group has used historically to bypass filename-based scrutiny. A DigiCert support employee executed the file, infecting the endpoint on April 2; DigiCert identified the compromise of a first endpoint on April 3 and a second, related endpoint on April 14 -- the delayed detection attributed to malfunctioning endpoint security software. From the compromised support endpoints, the attacker abused a support-analyst capability that allows proxying into customer accounts to access initialization codes tied to code-signing certificate renewal orders. DigiCert's own process treats possession of a valid initialization code plus an approved underlying order as sufficient to retrieve the resulting certificate -- no additional identity verification is required at that step. Using this weakness, the attacker generated legitimate EV Code Signing certificates across multiple customer accounts without the customers' knowledge, effectively laundering malware through a trusted certificate authority.
DigiCert revoked 60 code-signing certificates by April 17, 2026 in response, including 27 explicitly linked to the intruder's activity. Of those 27, 11 were identified after external security researchers submitted certificate problem reports (CPRs) tying the certificates to malware samples signed with them, and 16 were found through DigiCert's internal investigation. Community researchers subsequently confirmed that certificates from this batch had been used to sign samples of the Zhong Stealer malware family, an information-stealer with prior links to Chinese e-crime activity and cryptocurrency theft. DigiCert canceled all pending orders tied to the compromised accounts and implemented remediation including mandatory MFA for administrative support workflows, blocking proxy access to initialization codes for support staff, restricting file types accepted via chat/Salesforce case attachments, and improving support-system logging.
Security researchers at Expel subsequently attributed the operational tradecraft behind the DigiCert intrusion to a cluster they track as CylindricalCanine, assessed as a subgroup of the broader GoldenEyeDog ecosystem -- also referenced in industry reporting under the aliases APT-Q-27, Dragon Breath, and Miuuti Group. GoldenEyeDog is a Chinese cybercrime group historically associated with targeting the online gambling and gaming sectors via trojanized/counterfeit software downloads. The group's toolkit centers on the Golden Gh0st malware family: Golden Gh0st Loader (a DLL-sideloading first-stage loader active since at least 2015), Golden Gh0st RAT (a heavily modified fork of the public Gh0st RAT codebase providing remote command execution, keylogging, screenshot capture, process/service discovery, browser credential theft, proxy tunneling, file deletion, and Windows event-log clearing capability), and Zhong Stealer (a separate information-stealer family used for financially motivated cryptocurrency and credential theft, distributed here using the same stolen-certificate infrastructure).
Post-DigiCert-breach delivery infrastructure observed by researchers includes trojanized files masquerading as images, PDFs, and log files (e.g. newimage.pdf, updat.log, TASLogin.log) staged on Aliyun OSS (Hong Kong region) and, in a June 2026 follow-on wave, Google Cloud Storage buckets. Golden Gh0st RAT's DLL-sideloading component (TASLoginBase.dll / crashreport.dll, loaded by a legitimate-looking host binary such as down.exe or TASLogin) establishes persistence via scheduled tasks and newly created local administrator/backdoor accounts, then beacons to attacker-controlled infrastructure over unencrypted WebSocket connections on non-standard low ports (5188 and 5198) carrying AES-style encrypted payload content secured with a hardcoded REGISTERKEY/MODULEKEY pair, a technique that evades TLS-inspection-oriented network monitoring while still concealing payload contents at the application layer. The technique of signing this loader/RAT/stealer chain with legitimately issued, stolen-initialization-code EV certificates is the campaign's most consequential innovation: Windows SmartScreen and many endpoint security products grant elevated trust and reduced scrutiny to EV-signed binaries, and Microsoft Defender reportedly generated widespread false-positive detections against legitimately signed software in the aftermath as vendors and defenders scrambled to blocklist the abused certificate serials.
MITRE ATT&CK techniques used in TL-2026-1579
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1007 System Service Discovery; T1057 Process Discovery; T1087 Account Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1562.001 Impair Defenses: Disable or Modify Tools; T1574 Hijack Execution Flow
Persistence
T1053.005 Scheduled Task; T1136.001 Local Account; T1505 Server Software Component; T1543.003 Create or Modify System Process: Windows Service; T1574.002 Hijack Execution Flow: DLL Side-Loading
Credential Access
T1056 Input Capture; T1056.001 Keylogging; T1555 Credentials from Password Stores; T1555.003 Credentials from Web Browsers
Execution
T1059.003 Windows Command Shell; T1204 User Execution; T1204.002 Malicious File
Command and Control
T1071 Application Layer Protocol; T1071.001 Web Protocols; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel; T1573.001 Symmetric Cryptography
Privilege Escalation
T1078 Valid Accounts; T1078.003 Local Accounts; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
Initial Access
T1195 Supply Chain Compromise; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
defense-impairment
T1553.002 Code Signing; T1685.005 Clear Windows Event Logs
Impact
stealth
Resource Development
T1583 Acquire Infrastructure; T1583.006 Web Services; T1588 Obtain Capabilities; T1588.003 Code Signing Certificates
Affected products and versions in GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
- DigiCert — EV Code Signing Certificate issuance / support ticketing platform
Vulnerable versions: support ticketing/chat system, pre-April 2026 initialization-code access controls
Fixed in: post-2026-04-17 remediation: MFA enforcement, restricted proxy access to initialization codes, restricted chat/Salesforce attachment file types - Microsoft — Windows (SmartScreen / code-signing trust validation)
Vulnerable versions: all supported Windows versions relying on Authenticode EV certificate trust
Fixed in: N/A - mitigated via certificate revocation, not a Windows patch
Remediation for GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
Immediate actions
- Revoke trust for and blocklist all DigiCert EV code-signing certificate serials disclosed as compromised (60 revoked by DigiCert as of 2026-04-17, 27 explicitly attacker-linked)
- Hunt for outbound WebSocket connections to TCP ports 5188 and 5198, particularly to uu.goldeyeuu.io, wk.goldeyeuu.io, and api.keensie.com
- Block/alert on downloads from kkuu.oss-cn-hongkong.aliyuncs.com and the storage.googleapis.com/kiki001/ Google Cloud Storage path
- Search endpoints for the disclosed file hashes (down.exe, TASLoginBase.dll, TASLogin.log, crashreport.dll, updat.log, newimage.pdf, plugin32.dll, and the Golden Gh0st RAT sample)
- Audit newly created local administrator accounts and scheduled tasks created since April 2026 on internet-facing or support-adjacent endpoints
Workarounds
- Manually blocklist the disclosed C2 domains (goldeyeuu.io, keensie.com) and hosting paths at DNS/proxy layer pending full certificate-revocation propagation
Longer-term hardening
- Deploy EDR/behavioral detection tuned to DLL sideloading by legitimate-looking host binaries
- Implement code-signing certificate transparency monitoring / certificate problem report ingestion to catch abuse of legitimately issued certificates
- Restrict acceptable file types on customer support/chat and ticketing intake channels; sandbox-detonate all support-channel attachments before any human opens them
- Enforce MFA on all support/administrative workflows capable of accessing customer certificate initialization codes
- Remove or tightly scope support-analyst 'proxy into customer account' capabilities; require secondary approval for initialization-code retrieval
Weaknesses (CWE) in GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
CWE-295, CWE-494, CWE-732
Timeline of GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
- Golden Gh0st Loader first observed as an active DLL-sideloading tool in the wild, predating the DigiCert campaign by roughly a decade.
- GoldenEyeDog begins abusing code-signing certificates to bypass Windows SmartScreen; AnyRun documents associated Zhong Stealer payloads.
- Earlier GoldenEyeDog campaign phase observed using a first-stage executable delivery chain, preceding the DigiCert-certificate-enabled campaign.
- Elastic Security Labs publishes analysis of RONINGLOADER, a multi-stage NSIS-based loader used by the related Dragon Breath/GoldenEyeDog cluster to abuse a signed driver for PPL-based Defender disablement and deploy a modified Gh0st RAT.
- Updated RONINGLOADER samples masquerading as Chrome/Teams NSIS installers are identified, continuing the Dragon Breath campaign.
- Attacker delivers a malicious .scr file disguised as a customer screenshot through DigiCert's support chat/ticketing channel; a support employee executes it, infecting the endpoint.
- DigiCert identifies compromise of the first infected support endpoint.
- The second DigiCert support-analyst endpoint is compromised (distinct from its April 14 detection date already on record); the intrusion on this endpoint went undetected for roughly two weeks.
- A Golden Gh0st RAT implant sample tied to the intrusion is observed/compiled.
- DigiCert identifies a second, related infected endpoint; delayed detection attributed to malfunctioning endpoint security software.
- DigiCert revokes 60 code-signing certificates (27 explicitly linked to the attacker) and cancels all pending orders tied to compromised accounts, closing the attacker's access.
- DigiCert breach and screensaver-malware delivery method first publicly reported by SecurityWeek and Help Net Security.
- Security researchers confirm stolen EV code-signing certificates were used to sign Zhong Stealer malware samples.
- Black Swan Cybersecurity publishes a threat advisory on the DigiCert compromise detailing attacker IPs, malware hashes, and remediation guidance.
- Microsoft Defender false-positive wave reported across legitimately signed software as vendors blocklist abused certificate serials in response to the breach.
- Follow-on campaign wave observed using Google Cloud Storage (storage.googleapis.com/kiki001/) for payload hosting, alongside continued use of Aliyun OSS Hong Kong infrastructure.
- Expel publishes research attributing the DigiCert-incident tradecraft to a cluster it tracks as CylindricalCanine, a subgroup of GoldenEyeDog (aka APT-Q-27 / Dragon Breath / Miuuti Group).
- The Hacker News, Cyber Security News, GBHackers, and Cyberpress publish consolidated coverage naming GoldenEyeDog/CylindricalCanine as responsible for the DigiCert breach and certificate-hijacking campaign.
- The CTO at NCSC weekly summary digest includes coverage of the DigiCert compromise and certificate theft.
Update history for TL-2026-1579
- 2026-09-14 — GoldenEyeDog Subgroup CylindricalCanine Breaches DigiCert, Hijacks Code-Signing Certificates to Sign Malware: What changed Attribution confidence MEDIUM → HIGH, corroborated by Expel's formal CylindricalCanine attribution and an independent Black Swan Cybersecurity advisory identifying 7 attacker-controlled IPs. Severity, exploitability, and status
Sources cited for GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
- GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates
- GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft
- Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
- DigiCert Revokes Certificates After Support Portal Hack
- DigiCert breached via malicious screensaver file
- DigiCert Support Portal Hacked: Stolen EV Certificates Used to Sign Zhong Stealer Malware
- DigiCert suffers breach, stolen certificates used to sign malware
- DigiCert compromise precedes widespread Microsoft Defender false positives
- DigiCert Security Breach Linked to GoldenEyeDog Certificate Hijacking Campaign
- GoldenEyeDog Threat Group Behind DigiCert Code-Signing Certificate Attack
Threats related to GoldenEyeDog / CylindricalCanine Breaches DigiCert Support
Detection coverage for TL-2026-1579
As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1579 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.