Threats Tagged 'golden gh0st rat'

The CylindricalCanine subgroup of the Chinese cybercrime group GoldenEyeDog has been active since 2015, targeting primarily finance organizations in the Asia Pacific region. In April 2026, they compromised a DigiCert support member's device to steal code-signing certificates, which were then used to sign their malware. Their malware employs DLL sideloading, custom WebSocket protocols for command and control, and includes capabilities such as remote access, credential theft, keylogging, SOCKS proxy tunneling, and RDP backdoor creation. The group uses legitimate executables to load malicious DLLs that decrypt payloads disguised as log files. This threat leverages stolen legitimate certificates to bypass Windows SmartScreen protections since 2024.