Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

GoldenEyeDog is a Chinese cybercrime group active since 2015, with a subgroup named CylindricalCanine that uses modified versions of the 2008 Gh0st RAT malware (Golden Gh0st Loader and Golden Gh0st RAT). In April 2026, CylindricalCanine compromised a DigiCert support member's device to steal code-signing certificates intended for customers. These stolen certificates were used to sign malware, enabling it to bypass Windows SmartScreen. The malware uses DLL sideloading techniques and custom WebSocket protocols for command and control. Its capabilities include remote access, credential theft, keylogging, SOCKS proxy tunneling, and creating RDP backdoors. The group consistently uses legitimate executables to load malicious DLLs that decrypt payloads from files disguised as logs. The primary targets are finance organizations in the Asia Pacific region, and infection vectors include phishing campaigns.

The compromise of DigiCert code-signing certificates allows CylindricalCanine to sign malware with legitimate certificates, increasing the likelihood of successful delivery and execution by bypassing Windows SmartScreen protections. The malware's capabilities enable attackers to gain persistent remote access, steal credentials, log keystrokes, tunnel network traffic via SOCKS proxies, and establish RDP backdoors, posing significant risks to confidentiality, integrity, and availability of targeted systems. The focus on finance organizations in the Asia Pacific region indicates targeted financial espionage and potential fraud or theft.

No official patch or remediation is indicated for this threat. Organizations should be aware that the attackers use stolen legitimate code-signing certificates, which complicates detection based on signature trust alone. Mitigation should focus on enhancing phishing defenses, monitoring for suspicious DLL sideloading activities, and network traffic anomalies related to custom WebSocket communications. Incident response teams should validate the integrity of code-signing certificates and consider revocation of compromised certificates by DigiCert. Since this is an active threat leveraging stolen certificates, vigilance in endpoint detection and response is critical.