# GoldenEyeDog / CylindricalCanine Breaches DigiCert Support System to Hijack EV Code-Signing Certificates for Golden Gh0st RAT and Zhong Stealer Distribution

> Chinese cybercrime group GoldenEyeDog (via subgroup CylindricalCanine) compromised DigiCert's customer support ticketing/chat system in April 2026 by delivering a malicious file disguised as a screenshot, infecting two support endpoints and stealing initialization codes used to activate customer EV code-signing certificate renewals. The attackers used the stolen codes to obtain legitimate DigiCert EV code-signing certificates, which they used to sign Golden Gh0st Loader, Golden Gh0st RAT, and Zhong Stealer malware, enabling DLL sideloading attacks that bypass Windows code-signing trust controls.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-09-14T00:48:38.682Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1579
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-goldeneyedog-digicert-ev-signing-tl-2026-1579.webp?v=e84b45fe (Threadlinqs threat intel: GoldenEyeDog Hijacks DigiCert EV Signing: Detection & IOCs (TL-2026-1579) — Critical severity, 35 IOCs, 9 detection rules.)
- **ID:** TL-2026-1579
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** DragonBreath (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 35 (3 shown free below)

## Description

In April 2026, a threat actor contacted DigiCert's customer support through a chat/ticketing channel and submitted a malicious archive disguised as a customer screenshot. The payload was a Windows .scr screensaver-format executable, a technique the group has used historically to bypass filename-based scrutiny. A DigiCert support employee executed the file, infecting the endpoint on April 2; DigiCert identified the compromise of a first endpoint on April 3 and a second, related endpoint on April 14 -- the delayed detection attributed to malfunctioning endpoint security software. From the compromised support endpoints, the attacker abused a support-analyst capability that allows proxying into customer accounts to access initialization codes tied to code-signing certificate renewal orders. DigiCert's own process treats possession of a valid initialization code plus an approved underlying order as sufficient to retrieve the resulting certificate -- no additional identity verification is required at that step. Using this weakness, the attacker generated legitimate EV Code Signing certificates across multiple customer accounts without the customers' knowledge, effectively laundering malware through a trusted certificate authority.

DigiCert revoked 60 code-signing certificates by April 17, 2026 in response, including 27 explicitly linked to the intruder's activity. Of those 27, 11 were identified after external security researchers submitted certificate problem reports (CPRs) tying the certificates to malware samples signed with them, and 16 were found through DigiCert's internal investigation. Community researchers subsequently confirmed that certificates from this batch had been used to sign samples of the Zhong Stealer malware family, an information-stealer with prior links to Chinese e-crime activity and cryptocurrency theft. DigiCert canceled all pending orders tied to the compromised accounts and implemented remediation including mandatory MFA for administrative support workflows, blocking proxy access to initialization codes for support staff, restricting file types accepted via chat/Salesforce case attachments, and improving support-system logging.

Security researchers at Expel subsequently attributed the operational tradecraft behind the DigiCert intrusion to a cluster they track as CylindricalCanine, assessed as a subgroup of the broader GoldenEyeDog ecosystem -- also referenced in industry reporting under the aliases APT-Q-27, Dragon Breath, and Miuuti Group. GoldenEyeDog is a Chinese cybercrime group historically associated with targeting the online gambling and gaming sectors via trojanized/counterfeit software downloads. The group's toolkit centers on the Golden Gh0st malware family: Golden Gh0st Loader (a DLL-sideloading first-stage loader active since at least 2015), Golden Gh0st RAT (a heavily modified fork of the public Gh0st RAT codebase providing remote command execution, keylogging, screenshot capture, process/service discovery, browser credential theft, proxy tunneling, file deletion, and Windows event-log clearing capability), and Zhong Stealer (a separate information-stealer family used for financially motivated cryptocurrency and credential theft, distributed here using the same stolen-certificate infrastructure).

Post-DigiCert-breach delivery infrastructure observed by researchers includes trojanized files masquerading as images, PDFs, and log files (e.g. newimage.pdf, updat.log, TASLogin.log) staged on Aliyun OSS (Hong Kong region) and, in a June 2026 follow-on wave, Google Cloud Storage buckets. Golden Gh0st RAT's DLL-sideloading component (TASLoginBase.dll / crashreport.dll, loaded by a legitimate-looking host binary such as down.exe or TASLogin) establishes persistence via scheduled tasks and newly created local administrator/backdoor accounts, then beacons to attacker-controlled infrastructure over unencrypted WebSocket connections on non-standard low ports (5188 and 5198) carrying AES-style encrypted payload content secured with a hardcoded REGISTERKEY/MODULEKEY pair, a technique that evades TLS-inspection-oriented network monitoring while still concealing payload contents at the application layer. The technique of signing this loader/RAT/stealer chain with legitimately issued, stolen-initialization-code EV certificates is the campaign's most consequential innovation: Windows SmartScreen and many endpoint security products grant elevated trust and reduced scrutiny to EV-signed binaries, and Microsoft Defender reportedly generated widespread false-positive detections against legitimately signed software in the aftermath as vendors and defenders scrambled to blocklist the abused certificate serials.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1136.001 Local Account
- T1505 Server Software Component
- T1078 Valid Accounts
- T1078.003 Local Accounts
- T1574 Hijack Execution Flow
- T1574.001 DLL
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1070 Indicator Removal
- T1685.005 Clear Windows Event Logs
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1056 Input Capture
- T1056.001 Keylogging
- T1057 Process Discovery
- T1007 System Service Discovery
- T1087 Account Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1583 Acquire Infrastructure
- T1583.006 Web Services

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SPL — Malicious .scr/Masqueraded Attachment Executed on Support/Helpdesk Endpoint** (`TL-2026-1579-SPL-001`)

Detects execution of a screensaver (.scr) or double-extension file (e.g. newimage.pdf.scr, updat.log.exe) shortly after it was written to disk by a browser, chat client, or Salesforce/ticketing agent process — the GoldenEyeDog/CylindricalCanine initial-access vector used against DigiCert support staff (T1566.001, T1204.002, T1036.005).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1036.005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval img=lower(Image)
| where like(img, "%.scr") OR match(img, "(?i)\.(pdf|log|jpg|png)\.(exe|scr)$")
| eval parent=lower(ParentImage)
| where match(parent, "(?i)(chrome|msedge|firefox|outlook|teams|salesforce|slack)\.exe")
| table _time, ComputerName, User, Image, ParentImage, CommandLine, Hashes
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (".scr") or FolderPath matches regex @"(?i)\.(pdf|log|jpg|png)\.(exe|scr)$"
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","outlook.exe","teams.exe","slack.exe")
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, InitiatingProcessFileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Screensaver or Double-Extension File Executed From Browser/Chat Client
id: 7c1a4e2d-6b3f-4a91-9d0e-1f2b3c4d5e6a
status: experimental
description: Detects execution of a .scr file or a double-extension file (e.g. newimage.pdf.scr) spawned by a browser, chat, or ticketing-agent process, matching the GoldenEyeDog support-portal lure delivery method used against DigiCert.
references:
    - https://expel.com/blog/introducing-cylindricalcanine/
    - https://cybersecuritynews.com/goldeneyedog-behind-digicert-breach/
author: Threadlinqs Team
date: 2026-07-20
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
    - attack.tool.golden_gh0st
logsource:
    product: windows
    category: process_creation
detection:
    selection_ext:
        Image|endswith: '.scr'
    selection_double_ext:
        Image|re: '(?i)\.(pdf|log|jpg|png)\.(exe|scr)$'
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\outlook.exe'
            - '\teams.exe'
            - '\slack.exe'
    condition: (selection_ext or selection_double_ext) and selection_parent
falsepositives:
    - Legitimate screensaver installers downloaded and run intentionally by users
    - Marketing/PDF-viewer bundles that legitimately ship self-extracting .scr helpers (rare)
level: high
```

**Known false positives:**

- Legitimate .scr screensaver installers manually downloaded and executed by a user

**Tuning notes:** Scope to support/helpdesk/CS-adjacent OU or asset tag first to control volume; add filename allow-list for known internal screensaver deployment tooling before enabling org-wide.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- KQL — Support/Helpdesk Endpoint Ingests and Opens Trojanized Support-Ticket Attachment (locked: unlock with TL Creds)
- KQL — Scheduled Task Creation Followed by New Local Administrator Account (Golden Gh0st Persistence Pair) (locked: unlock with TL Creds)
- KQL — Windows Security Event Log Cleared on Recently-Compromised Endpoint (Anti-Forensics) (locked: unlock with TL Creds)
- Sigma — EV Code-Signed Binary With No Prior Reputation Loads Unsigned DLL (Certificate Abuse Pattern) (locked: unlock with TL Creds)
- Sigma — Golden Gh0st RAT Credential/Screenshot/Keylog Collection Burst Post-Sideload (locked: unlock with TL Creds)
- Sigma — Cloud-Storage-Hosted Payload Download Immediately Preceding Signed-Binary Execution (Aliyun OSS HK / GCS) (locked: unlock with TL Creds)
- SPL — Golden Gh0st DLL Sideload via down.exe / TASLogin Host Binary (locked: unlock with TL Creds)
- SPL — Golden Gh0st RAT WebSocket C2 Beacon on Ports 5188/5198 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 35)

Defanged, TLP:CLEAR.

- IP address: `82.23.186[.]8`
- Domain: `uu[.]goldeyeuu[.]io`
- File hash: `4eaebd93e23be3427d4c1349d64bef4b5fc455c93aebb9b5b752981e9266488e`

Full set of 35 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates](https://cybersecuritynews.com/goldeneyedog-behind-digicert-breach/)
- [GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft](https://thehackernews.com/2026/07/goldeneyedog-subgroup-linked-to.html)
- [Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident](https://expel.com/blog/introducing-cylindricalcanine/)
- [DigiCert Revokes Certificates After Support Portal Hack](https://www.securityweek.com/digicert-revokes-certificates-after-support-portal-hack/)
- [DigiCert breached via malicious screensaver file](https://www.helpnetsecurity.com/2026/05/04/digicert-breach-code-signing-certificates-malware/)
- [DigiCert Support Portal Hacked: Stolen EV Certificates Used to Sign Zhong Stealer Malware](https://cipherssecurity.com/digicert-support-portal-breach-ev-code-signing-zhong-stealer-2026/)
- [DigiCert suffers breach, stolen certificates used to sign malware](https://cyberinsider.com/digicert-suffers-breach-stolen-certificates-used-to-sign-malware/)
- [DigiCert compromise precedes widespread Microsoft Defender false positives](https://www.threatlocker.com/blog/digicert-compromise-precedes-widespread-microsoft-defender-false-positives)
- [DigiCert Security Breach Linked to GoldenEyeDog Certificate Hijacking Campaign](https://cyberpress.org/goldeneyedog-hijacks-digicert-certificates/)
- [GoldenEyeDog Threat Group Behind DigiCert Code-Signing Certificate Attack](https://gbhackers.com/goldeneyedog-threat-group/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1579