Key Takeaways
- The April 2026 DigiCert breach was carried out by a threat cluster named CylindricalCanine, a sub‑group of the Chinese cybercrime outfit GoldenEyeDog (also tracked as APT‑Q‑27, Dragon Breath, Miuuti Group).
- CylindricalCanine distributes a modified Gh0st RAT variant called Golden Gh0st RAT via a multi‑stage loader (RONINGLOADER) that masquerades as legitimate installers.
- The attackers exploited a support‑portal function that allowed them to view initialization codes for approved EV Code Signing orders, enabling them to fraudulently obtain and later weaponize code‑signing certificates.
- DigiCert revoked 60 certificates from four CAs; 27 of those were directly linked to the threat actor and used to sign Zhong Stealer malware.
- The attack chain relies on phishing‑style chat messages delivering a ZIP file with a malicious .scr payload, which triggers DLL side‑loading to execute an encrypted update.log that finally loads Golden Gh0st RAT.
- Golden Gh0st RAT provides extensive capabilities: persistence, data theft (including browsers and messaging apps), SOCKS tunneling, keystroke logging, screenshot capture, process enumeration, shell command execution, additional payload drop, and Windows Event log clearing.
- The incident highlights a growing trend of Chinese‑linked threat actors abusing code‑signing certificates to bypass trust mechanisms, joining groups such as Black Basta, TamperedChef, and Rhysida.
- DigiCert has since patched the support portal to mask initialization codes from proxied users and recommends tighter validation of chat‑delivered files, enhanced endpoint detection, and monitoring for anomalous DLL side‑loading activity.
Overview of the Threat Actor Attribution
In April 2026, cybersecurity researchers attributed the DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which released technical details of the event, identified CylindricalCanine as a sub‑group of the Chinese cybercrime group GoldenEyeDog—also known as APT‑Q‑27, Dragon Breath, and Miuuti Group. GoldenEyeDog has been active since at least 2015 and is notorious for targeting the gambling and gaming sectors through counterfeit websites that distribute malware‑laden software. The attribution underscores the continued evolution of Chinese‑linked threat actors who adapt their tactics to high‑value targets such as certificate authorities.
Golden Gh0st RAT and Its Delivery Mechanism
Central to CylindricalCanine’s operations is a modified version of the classic Gh0st RAT (aka Farfli), termed Golden Gh0st RAT. This modular malware is disseminated via a component called Golden Gh0st Loader. In a November 2025 report, Elastic Security Labs described the adversary’s use of a multi‑stage loader codenamed RONINGLOADER to push a Gh0st RAT variant through NSIS installers that masquerade as legitimate programs such as Google Chrome and Microsoft Teams. The loader’s design allows the attackers to bypass initial security checks and establish a foothold on victim systems before deploying the full RAT capabilities.
Historical Campaigns and Malware Overlaps
Golden Gh0st RAT exhibits notable behavioral and tactical overlaps with malware previously observed by Chinese security vendor QiAnXin in 2020, which was tied to a gambling‑industry attack campaign dating back to 2019. Additionally, ANY.RUN documented a malware in February 2025 named Zhong Stealer that shares code and functionality with Golden Gh0st RAT. Earlier in 2026, a separate campaign linked to the same group targeted Web3 customer‑support staff, using suspicious links in chat windows to deliver Gh0st RAT. These patterns illustrate the group’s consistent focus on finance‑related entities in the Asia‑Pacific region and its reuse of proven malware families across different victim sets.
The Initial Compromise of DigiCert’s Support Portal
The DigiCert breach began when a threat actor contacted the company’s support team via a customer‑chat channel on 2 April 2026. The actor sent a ZIP file disguised as a customer screenshot; inside the archive lay a .scr executable containing a malicious payload. Once the support analyst opened the file, the payload executed and leveraged a limited function within DigiCert’s internal support portal. This function permits authenticated support analysts to view customer accounts from the customer’s perspective to facilitate troubleshooting. By abusing this feature, the attacker gained access to initialization codes for approved but pending EV Code Signing certificate orders across a limited set of customer accounts.
Exploitation of Initialization Codes and Certificate Theft
The critical flaw was that possession of an initialization code, combined with an approved order, was functionally sufficient to obtain EV Code Signing certificates from the associated CAs. Using the harvested codes, the attacker fraudulently obtained certificates from DigiCert’s internal portal. DigiCert later confirmed that it revoked 60 certificates issued by the following authorities:
- DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1
- DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
- GoGetSSL G4 CS RSA4096 SHA256 2022 CA‑1
- Verokey High Assurance Secure Code EV
Of these, 27 certificates were explicitly linked to CylindricalCanine and subsequently used to sign Zhong Stealer malware artifacts, allowing the malicious code to appear trusted to end‑users and security tools.
Revocation Details and Impacted Certificate Authorities
DigiCert’s revocation notice listed the four CAs whose certificates were compromised. The two DigiCert‑issued certificates (SHA256 and SHA384 variants) accounted for the majority of the stolen material, while the GoGetSSL and Verokey certificates represented smaller subsets. The revocation effectively invalidated the fraudulent code‑signing material, but the window during which the certificates were valid allowed the attackers to distribute signed Zhong Stealer samples that evaded many reputation‑based defenses. The incident prompted DigiCert to implement a code change that masks initialization codes from proxied users on both its EU and U.S. platforms, regardless of whether access occurs via the UI or API.
Attack Chain: From Phishing Chat to DLL Side‑Loading
Expel outlined the primary tactic employed by CylindricalCanine: delivering files disguised as screenshots within phishing‑style chat messages. The message contains a link that, when clicked, downloads additional payloads from an external server. The ultimate goal is to trigger a DLL side‑loading chain—a technique where a legitimate executable is coerced into loading a rogue DLL. In this attack, the side‑loaded DLL displays a decoy PDF showing an HTTP 503 “Service Unavailable” error to distract the user while it proceeds to load an encrypted payload named update.log. The encrypted payload is then decrypted and executed, culminating in the deployment of Golden Gh0st RAT onto the victim host.
Capabilities and Persistence Mechanisms of Golden Gh0st RAT
Once installed, Golden Gh0st RAT furnishes the attacker with a broad suite of capabilities typical of advanced Gh0st variants. The malware can establish persistence through registry modifications or scheduled tasks, harvest sensitive data from targeted applications (including Skype, Google Chrome, Mozilla Firefox, 360 Secure Browser, 360 Speed Browser, and Tencent QQ Browser), activate a SOCKS proxy tunnel for covert communication, suppress display output to avoid user notice, log keystrokes, capture screenshots, enumerate running processes, execute arbitrary shell commands, drop additional payloads, and clear Windows Event logs to hinder forensic analysis. Its functionality is governed by an internal module dispatcher and plug‑in architecture, allowing operators to enable or disable specific features on the fly based on mission requirements.
Broader Implications and Relation to Other Threat Actors
CylindricalCanine’s abuse of code‑signing certificates places it alongside other notable threat groups such as Black Basta, TamperedChef (aka EvilAI), and Rhysida, all of which have leveraged stolen or fraudulent certificates to bypass trust controls. The incident underscores a shifting landscape where financially motivated Chinese cybercrime actors are expanding beyond traditional gaming and gambling targets to infiltrate critical infrastructure like certificate authorities. Organizations should therefore enforce strict validation of inbound chat attachments, monitor for anomalous DLL side‑loading behavior, implement least‑privilege access to internal support functions, and maintain up‑to‑date threat intelligence on Gh0st RAT variants and their associated loader families. By hardening these vectors, defenders can reduce the likelihood of similar supply‑chain compromises in the future.