ExpelPublished
Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
By Aaron Walton
Excerpt
TL;DR
Chinese cybercrime group, GoldenEyeDog, has been regularly updating their malware and tactics since 2015. We’ve observed them regularly leveraging code-signing certificates to bypass Windows’s SmartScreen since 2024. They leverage several malware, including one we’ve seen primarily documented in Chinese language publications, and are calling it “Golden Gh0st RAT”.
In April 2026, GoldenEyeDog used their malware to access a support member’s device at DigiCert, a code-signing certificate provider, and leveraged their access to steal certificates inten…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Expel on expel.com.
Mentioned in the excerpt
More from Expel1
- Inside Lazarus: How North Korea uses AI to industrialize attacks on developersExpel · Published 22 Apr
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
