Golden EyeDog Subgroup Linked to Digi Cert Breach and Code-Signing Certificate Theft
Summary: Expel attributed the April 2026 DigiCert security incident to CylindricalCanine, a sub-group of the Chinese cybercrime group GoldenEyeDog (aka APT-Q-27, Dragon Breath, Miuuti Group), which used malware to access a support member's device and steal certificates intended for DigiCert customers. DigiCert said a threat actor delivered a ZIP file disguised as a customer screenshot containing a .scr executable via a customer chat channel, then used a support portal function to access initialization codes for approved but pending EV Code Signing orders, and the company revoked 60 certificates, 27 of them explicitly linked to the threat actor and used to sign Zhong Stealer malware artifacts.
Key Takeaway: An initialization code plus an approved order was functionally sufficient to obtain EV Code Signing certificates across customer accounts, and DigiCert's own threat model did not account for a compromised analyst account viewing those codes through the portal - a gap now closed by masking them from proxied users.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026