On 2 April 2026, someone posing as a customer opened a support chat with DigiCert — one of the world’s most trusted certificate authorities — and attached a ZIP file. Inside was a screensaver executable. Within hours, a Chinese Advanced Persistent Threat (APT) subgroup had a foothold on a DigiCert analyst’s workstation. By the time the dust settled, 60 Extended Validation (EV) code-signing certificates had been revoked, and 27 of them had already been weaponised to sign malware designed to bypass enterprise security tools.

The story, disclosed publicly on 17 July 2026 by Expel threat intelligence researchers, is not just another breach headline. It is a direct challenge to one of the most fundamental assumptions in enterprise security: that a digitally signed binary is a safe binary. For Indian IT leaders and SOC teams operating under zero-trust mandates, the implications are stark.

Key Takeaways

  • Chinese APT subgroup CylindricalCanine (part of GoldenEyeDog / APT-Q-27) breached DigiCert on 2 April 2026 via a malicious screensaver in a support chat.
  • 60 EV Code Signing certificates were revoked between 14–17 April 2026; 27 were explicitly linked to the threat actor.
  • The stolen certificates were used to sign Zhong Stealer malware, targeting finance organisations across the Asia-Pacific region — including India.
  • The final-stage payload is Golden Gh0st RAT, a capable remote-access trojan with keylogging, screenshot, SOCKS proxy, and event-log-wiping capabilities.
  • DigiCert has acknowledged a design flaw: support portal initialisation codes for pending certificate orders were visible to compromised analyst accounts.
  • Standard antivirus and endpoint tools that rely on signature trust will not flag malware signed with legitimate EV certificates.

Who Is GoldenEyeDog? A Brief Threat Profile

GoldenEyeDog — tracked under the aliases APT-Q-27, Dragon Breath, and Miuuti Group — is a Chinese cybercrime collective active since at least 2015. Its original hunting ground was the online gambling and gaming industry, where it pioneered counterfeit website lures and credential-harvesting campaigns. Over the past two years, however, GoldenEyeDog has pivoted decisively toward financial services and Web3 companies in the Asia-Pacific region.

CylindricalCanine is a recently identified subgroup within this ecosystem. Expel’s Aaron Walton, who led the attribution research, describes it as a specialised cluster focused on supply-chain and trust-chain attacks — going upstream to compromise the very tools organisations rely on to establish trust, rather than targeting victim organisations directly.

This is the same strategic logic that drove the TeamPCP supply chain attack that poisoned trusted developer tools earlier this year. Sophisticated threat actors have learned that the fastest route past an organisation’s defences is to corrupt something that organisation already trusts unconditionally.

How the Attack Unfolded: A Step-by-Step Breakdown

The DigiCert breach is a masterclass in low-and-slow social engineering. Here is the verified timeline:

Date Event
2 April 2026 Threat actor contacts DigiCert support chat; delivers ZIP file disguised as a customer screenshot containing a .scr executable.
2 April 2026 Analyst executes the screensaver, triggering a DLL side-loading chain. A decoy PDF (displaying an HTTP 503 message) is shown while the encrypted payload update.log loads in the background.
April 2–14 Golden Gh0st RAT establishes persistence. Attacker accesses the internal support portal and harvests initialisation codes for pending EV Code Signing certificate orders.
14–17 April 2026 DigiCert identifies the compromise and revokes 60 EV Code Signing certificates across four issuing CAs.
17 July 2026 Expel publicly attributes the attack to CylindricalCanine and confirms 27 certificates were used to sign Zhong Stealer malware samples.

The most striking detail is what the attackers went after. They did not exfiltrate customer databases or deploy ransomware. They hunted for certificate initialisation codes — tokens that let a certificate applicant download a freshly issued EV signing certificate. By intercepting those codes before the legitimate customer ever collected their certificate, CylindricalCanine was able to obtain fully legitimate, DigiCert-issued EV certificates in the names of DigiCert customers.

Technical Breakdown: The Attack Chain and the Malware

The intrusion leveraged a four-stage infection chain:

  1. Initial access: A weaponised .scr (Windows Screensaver) executable inside a ZIP, delivered via a support ticketing chat interface. Most email gateways and DLP solutions do not inspect chat attachments with the same rigour as email.
  2. DLL side-loading: The screensaver used a legitimate Windows executable to load a rogue DLL, evading application allowlisting controls that trust the parent process.
  3. Payload decryption: An encrypted file named update.log was decoded at runtime, making static-analysis detection unreliable.
  4. Golden Gh0st RAT (final stage): A heavily modified fork of the open-source Gh0st RAT, extended with modules that target Skype, Chrome, Firefox, 360 Secure Browser, Tencent QQ Browser, and credential stores for common applications.

Golden Gh0st RAT’s capabilities are broad enough to constitute a full-spectrum espionage platform: keystroke logging, live screenshot capture, SOCKS5 proxy tunnelling (useful for lateral movement and C2 obfuscation), process enumeration, shell command execution, secondary payload dropping, and — crucially — Windows Event Log clearing to hamper forensic investigation.

The stolen certificates cover four issuing CAs:

  • DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1
  • DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
  • GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1
  • Verokey High Assurance Secure Code EV

The weaponised certificates were used to sign Zhong Stealer, an information-stealing malware first documented by ANY.RUN in February 2025. Signed with EV certificates, Zhong Stealer artifacts are indistinguishable from legitimate, trusted software by most endpoint security tools that rely on certificate chain validation.

Why This Matters Especially for India

CylindricalCanine’s stated targeting priority is finance organisations in the Asia-Pacific region. India’s rapid digitisation of banking, insurance, and fintech — combined with a large base of Windows-based enterprise infrastructure — makes it a high-value target. The group’s historical use of Chinese-language lures and targeting of Tencent QQ Browser (widely used by overseas Chinese communities) does not limit its reach; Zhong Stealer has been distributed broadly.

State-sponsored Chinese cyber operations against Indian targets are not new — see the post-Galwan Valley infrastructure incidents in 2020 and subsequent CERT-In alerts. What is new is the sophistication: rather than exploiting a known CVE, this campaign corrupted the PKI trust chain itself. That fundamentally changes the defensive calculus. This escalating threat landscape also resonates with recent findings from our coverage of AI-driven ransomware that similarly bypasses conventional defences.

What You Should Do Now: Sanjay Seth’s Defensive Playbook

This attack is a forcing function for zero-trust architecture. No signature, no certificate, no established trust relationship should be treated as proof of safety. Here is a concrete action plan:

  1. Audit your code-signing trust anchors immediately. Check whether any software deployed in your environment was signed by certificates issued by DigiCert Trusted G4 Code Signing CA1 (SHA256 or SHA384 variant), GoGetSSL G4, or Verokey High Assurance Secure Code EV between January and April 2026. Use sigcheck -tv -a <binary> (Sysinternals) to inspect certificate thumbprints against the Expel and DigiCert revocation lists.
  2. Enable certificate revocation checking at your endpoints. Many organisations disable OCSP and CRL checks for performance reasons. Re-enable them. Revoked certificates must be flagged at execution time, not just at install time.
  3. Harden your support-channel file acceptance policies. DigiCert’s own post-mortem acknowledges that its support portal accepted file attachments without sufficient sandboxing. Review your own vendor support interfaces, helpdesk platforms, and ITSM tools for the same exposure.
  4. Deploy behaviour-based EDR, not just signature-based AV. Golden Gh0st RAT’s event-log clearing is a detectable behaviour. A behaviour-based EDR (CrowdStrike Falcon, Microsoft Defender for Endpoint on high-alert policy, FortiEDR) that monitors for mass event-log deletion should have triggered even when the binary itself passed signature checks.
  5. Implement Zero Trust for software execution. Use application control policies (Windows Defender Application Control / WDAC, or AppLocker) to restrict execution to an explicitly approved allowlist — rather than an implicit trust list based on publisher signature alone. A certificate-based allowlist is broken by this attack; a hash-based or path-based allowlist is not.
  6. Threat-hunt for Zhong Stealer IOCs. Query your SIEM and EDR for the issuing CA thumbprints published by Expel, and correlate with outbound SOCKS5 connections or unusual browser credential-store access patterns consistent with Golden Gh0st RAT.
  7. Notify your third-party software vendors. If your organisation issued an EV Code Signing certificate via DigiCert between January and April 2026 and has not yet received a revocation notice, contact DigiCert support to confirm the status of your certificate.

Frequently Asked Questions

Are the 60 revoked certificates now useless to attackers?

Revocation means operating systems and browsers should reject binaries signed with those certificates — provided OCSP/CRL checking is active at the point of execution. However, revocation checks are disabled or unreliable in many enterprise environments, especially for code-signed executables run from network shares or removable media. Treat revocation as a mitigation, not a fix. The malware samples signed before revocation may still execute on unpatched or CRL-disabled endpoints.

Does this affect DigiCert TLS/HTTPS certificates used on websites?

No. The compromised certificates were specifically EV Code Signing certificates, which are used to sign executable files and software packages — not TLS server certificates used to secure website connections. Your HTTPS infrastructure is unaffected by this incident. However, it is a reminder to audit certificate issuance workflows for all certificate types.

How is this different from a typical software supply chain attack?

In a typical supply chain attack (such as SolarWinds or XZ Utils), attackers compromise the vendor’s build pipeline and inject malicious code into legitimate software that customers then install. In this case, CylindricalCanine bypassed the software vendor entirely and stole the signing credential itself. The attackers can now sign any malware with a certificate that chains to a globally trusted root CA — without ever touching the software vendor’s codebase.

What should a CISO report to the board about this incident?

Frame it simply: a nation-state threat actor has demonstrated the ability to obtain certificates that make malware look like trusted software from a legitimate company. The defensive response requires moving from implicit trust in digital signatures to explicit verification of behaviour at runtime — which is the operational definition of zero-trust for endpoint security. Board-level investment in behaviour-based EDR and application control policy enforcement is now justified by this specific demonstrated threat.

Secure Your Enterprise Before the Next Certificate Comes for You

The DigiCert breach is a watershed moment in trust-chain security. When attackers can obtain legitimately issued EV certificates from a globally trusted CA, every assumption built on “this software is digitally signed and therefore safe” must be revisited. Zero-trust is not a marketing buzzword here — it is the only architectural response to an adversary who has learned to weaponise trust itself.

At P J Networks, Sanjay Seth has been helping Delhi NCR enterprises and SOC teams implement behaviour-based zero-trust policies that do not rely on certificate trust alone. If you want a rapid assessment of your endpoint trust architecture, your code-signing exposure, or your SIEM’s readiness to detect Golden Gh0st RAT-style behaviours, reach out for a confidential security assessment.

Sources: Expel — Introducing CylindricalCanine | The Hacker News — GoldenEyeDog Subgroup Linked to DigiCert Breach | CyberSecurityNews — DigiCert Hacked via Screensaver File