Answer Brief
The stolen certificates were used to sign Zhong Stealer malware, highlighting a critical gap in internal trust controls at certificate authorities. The incident underscores how legitimate support functions, when inadequately isolated, can be weaponized in supply chain attacks targeting software signing infrastructure.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
GoldenEyeDog first observed active
- 2
QiAnXin detects Gh0st RAT variant targeting gambling industry
- 3
ANY.RUN documents Zhong Stealer malware
- 4
Elastic Security Labs details RONINGLOADER use by GoldenEyeDog
Executive Summary: The stolen certificates were used to sign Zhong Stealer malware, highlighting a critical gap in internal trust controls at certificate authorities. The incident underscores how legitimate support functions, when inadequately isolated, can be weaponized in supply chain attacks targeting software signing infrastructure.
Why It Matters
The April 2026 DigiCert breach, attributed to the CylindricalCanine subgroup of GoldenEyeDog, reveals a critical vulnerability in how certificate authorities manage internal trust boundaries. Rather than exploiting external-facing systems, the attackers targeted a legitimate internal function within DigiCert’s customer-support portal — the ability for support analysts to view initialization codes for approved but pending EV code-signing certificate orders. By compromising a support analyst’s workstation via phishing lures delivered through customer chat channels, the threat actors abused this trusted workflow to fraudulently obtain 60 code-signing certificates, 27 of which were explicitly linked to the actor and subsequently used to sign Zhong Stealer malware. This incident demonstrates that even well-defended certificate issuance processes can be undermined when internal support tools lack sufficient segmentation from high-privilege operations. Technical analysis from Expel shows a sophisticated, multi-stage infection chain beginning with phishing emails or support portal submissions containing links to malicious ZIP files. These files deploy a .scr executable that triggers a DLL side-loading mechanism, leveraging legitimate Windows executables to load rogue DLLs while displaying a decoy HTTP 503 error PDF to avoid suspicion. The final payload is an encrypted update.log file that loads Golden Gh0st RAT, a modular variant of Gh0st RAT enhanced with plugin-based capabilities for persistence, credential theft (including from Skype, Chrome, Firefox, and Tencent QQ Browser), SOCKS proxy tunneling, keylogging, screenshot capture, process enumeration, shell command execution, and Windows Event log clearing. The use of RONINGLOADER, first detailed by Elastic Security Labs in November 2025, highlights the group’s investment in evasion-focused delivery mechanisms. Recent sightings as late as January 2026 confirm ongoing development and deployment of this loader, which uses NSIS-wrapped installers mimicking legitimate applications to bypass initial defenses. Expel’s hypothesis that RONINGLOADER may be operated by a distinct team within GoldenEyeDog suggests internal specialization — possibly separating initial access, payload delivery, and post-exploitation teams — increasing the group’s operational resilience and adaptability. This modularity aligns with broader trends in cybercrime where threat actors divide labor to improve efficiency and reduce attribution risk. The group’s historical focus on gambling and gaming sectors in the Asia-Pacific region, using counterfeit websites to distribute malware, contrasts with this incident’s targeting of high-value trust infrastructure. The theft of EV code-signing certificates — which confer the highest level of trust in software signing — enables attackers to sign malware that bypasses signature-based defenses in enterprise environments, effectively turning a core security control into a liability. This tactic mirrors recent supply chain compromises involving code-signing abuse by groups such as Black Basta, Rhysida, and TamperedChef (EvilAI), signaling a growing trend among financially motivated and espionage-linked actors to undermine software trust chains. For certificate authorities and code-signing platforms, the DigiCert breach reinforces the need to enforce strict segmentation between support functions and certificate issuance workflows. Initialization codes and approval tokens must never be exposed via proxied user sessions, and real-time anomaly detection should monitor certificate requests originating from unusual internal access paths. Organizations should validate the integrity of signed software through multi-layered verification, including certificate reputation checks and behavioral analysis, rather than relying solely on signature validity. Continued monitoring of GoldenEyeDog’s TTPs — particularly the use of customer chat channels for initial access, DLL side-loading for execution, and certificate theft for evasion — is essential for defending against similar supply chain compromises. The incident also raises broader questions about the security of internal trust models in critical service providers, where legitimate functions designed for operational efficiency can become attack vectors when not properly isolated from sensitive operations.
Event Type: security
Importance: high
Affected Companies
- ANY.RUN
- DigiCert
- Elastic Security Labs
- Expel
- QiAnXin
Affected Sectors
- certificate authority
- cybersecurity
- financial services
- gaming
- software development
Key Numbers
- Certificates revoked by DigiCert: 60
- Certificates explicitly linked to threat actor: 27
- GoldenEyeDog activity start: 2015
- DigiCert breach date: 2026-04-02
- RONINGLOADER sightings: January 2026
- Zhong Stealer documentation: February 2025
Timeline
- GoldenEyeDog first observed active
- QiAnXin detects Gh0st RAT variant targeting gambling industry
- ANY.RUN documents Zhong Stealer malware
- Elastic Security Labs details RONINGLOADER use by GoldenEyeDog
- Recent iterations of RONINGLOADER identified
- Threat actor contacts DigiCert support via chat, delivers malicious ZIP with .scr payload
- DigiCert reveals breach, revokes 60 fraudulently obtained code-signing certificates
- Expel and The Hacker News attribute breach to CylindricalCanine subgroup of GoldenEyeDog
Frequently Asked Questions
What is CylindricalCanine and how is it related to GoldenEyeDog?
CylindricalCanine is a threat activity cluster attributed to the April 2026 DigiCert breach.
How did the attackers steal code-signing certificates from DigiCert?
On April 2, 2026, the threat actor contacted DigiCert's support team via a customer chat channel, delivering a ZIP file disguised as a customer screenshot. The file contained a .scr executable with a malicious payload. Using a limited function in the customer-support portal that allows authenticated analysts to access customer accounts from the customer’s perspective, the actor viewed initialization codes for approved but pending EV code-signing orders. Possession of these codes, combined with approved orders, was functionally sufficient to fraudulently obtain certificates.
What malware was signed using the stolen DigiCert certificates?
The stolen DigiCert code-signing certificates were used to sign Zhong Stealer malware artifacts. This allowed the threat actor to evade detection by making the malware appear legitimate to signature-based security systems.
What is Golden Gh0st RAT and how is it delivered in this attack?
Golden Gh0st RAT is a modified version of Gh0st RAT used by GoldenEyeDog. It is delivered via a multi-stage loader called RONINGLOADER through NSIS installers masquerading as legitimate software like Google Chrome or Microsoft Teams. The attack chain uses DLL side-loading: a legitimate executable loads a rogue DLL while displaying a decoy HTTP 503 error PDF, which then loads an encrypted payload ('update.log') that executes Golden Gh0st RAT.
What mitigation has DigiCert implemented after the breach?
DigiCert has deployed a code change to mask initialization codes from proxied users on both E.U. and U.S. platforms, accessible via UI or API. This prevents compromised support analyst accounts from exposing sensitive certificate issuance data through the customer-support portal function.