GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates

GoldenEyeDog, a Chinese cybercrime group linked to the Golden Gh0st malware family, is back in focus after an intrusion at DigiCert exposed the risks around code-signing certificates.

The attackers used the access to intercept customer certificate activation codes and sign their own malicious files.

The operation relied on a simple but effective route into a sensitive environment.

Malicious files were disguised as screenshots, delivered through phishing emails or support-ticket submissions, and opened by staff who believed they were reviewing customer content.

Expel said in a report shared with Cyber Security News (CSN) that the activity was carried out by a GoldenEyeDog subgroup it calls CylindricalCanine.

Researchers linked the group to Golden Gh0st Loader and Golden Gh0st RAT, malware tools that have evolved through several campaigns since 2015.

The case also highlights a larger problem for defenders. A valid code-signing certificate can make a malicious program appear more trustworthy to Windows security checks, allowing attackers to gain an advantage before detection tools or users recognize the danger.

GoldenEyeDog Hackers Group Behind DigiCert Breach

The April 2026 breach began when a DigiCert support employee ran a malicious file received through the company’s ticketing system.

The compromised device gave the attackers access to initialization codes associated with customers renewing code-signing certificates.

Those codes are used to activate the hardware tokens required for signing software. By stealing them, the attackers could intercept certificates intended for legitimate customers, then use them to sign malware that looked more credible to security controls.

Earlier reporting on the weaponized screensaver DigiCert breach documented how the incident involved malware previously tracked as Zhong Stealer.

Expel’s analysis indicates that the malware is more than an information stealer. Golden Gh0st RAT can give operators remote access, collect browser credentials, capture screenshots, list running processes, execute commands, and erase traces of activity from infected systems.

The RAT also supports persistence, meaning it can remain active after a reboot.

One observed plugin created a backdoor account with administrator privileges and altered system settings to enable remote desktop access, giving attackers another way to return to a compromised device.

Loader Tactics and Detection

Golden Gh0st Loader commonly uses DLL sideloading, a technique in which a legitimate Windows application is tricked into loading a malicious library placed beside it. The library then decrypts and loads the actual RAT from a file that may be disguised as a log file.

That approach makes the infection chain harder to spot because trusted applications can be used as part of the execution process.

Similar abuse has appeared in the recent AsyncRAT sideloading campaign, where attackers hid malicious activity behind apparently normal software components.

In the recent campaign, the loader retrieved additional files from cloud-hosted locations, including a legitimate executable, supporting runtime files, a malicious DLL, an encrypted payload, and decoy documents.

A fake image or PDF displaying a 503 error helped make the activity appear less suspicious to victims.

Golden Gh0st RAT communicates with its command-and-control servers through unencrypted WebSocket connections, while encrypting the content inside those connections.

Analysts observed the malware using low-numbered ports 5188 and 5198, which can help defenders investigate unusual outbound traffic.

Security teams should closely validate attachments and download links submitted through support portals, especially files presented as screenshots or customer evidence.

Staff handling tickets should use isolated review systems where possible and verify unexpected files through a separate channel before opening them.

Defenders should also watch for suspicious DLLs loaded by legitimate applications, unexpected scheduled tasks, new local administrator accounts, and outbound WebSocket traffic to the listed domains.

Monitoring for the encrypted RAT command traffic and applying network detections for Golden Gh0st’s distinctive communications can improve the chance of catching the activity early.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.