GoldenEyeDog Threat Group Behind DigiCert Code-Signing Certificate Attack

GoldenEyeDog, a Chinese cybercrime group increasingly tracked as an advanced threat cluster, has been linked to a sophisticated intrusion into DigiCert that enabled the theft and abuse of legitimate code-signing certificates.

The group has been active since at least 2015 and, since 2024, has consistently leveraged stolen or abused code-signing certificates to bypass Windows SmartScreen protections and establish trust for malicious binaries.

The April 2026 DigiCert incident marked a significant escalation. Threat actors compromised a DigiCert support employee’s device via malware delivered through a support ticketing workflow.

This access enabled interception of certificate initialization codes intended for legitimate customers.

These codes, which activate hardware-backed signing tokens, were then used to sign malicious payloads, effectively granting them a veneer of legitimacy.

At the center of the campaign is a malware suite researchers now classify as Golden Gh0st Loader and Golden Gh0st RAT. While previously mischaracterized as “Zhong Stealer” in reports such as Any.Run’s 2025 analysis (https://any.run/cybersecurity-blog/zhong-stealer-malware-analysis/).

Deeper investigation shows the payload is a full-featured remote access trojan derived from the widely abused Gh0st RAT (https://attack.mitre.org/software/S0032/).

The RAT supports modular plugins for credential harvesting, remote shell execution, SOCKS proxying, screenshot capture, and RDP backdoor deployment.

Security researchers in Expel, attribute the activity to a subgroup dubbed “CylindricalCanine,” aligned with GoldenEyeDog (also known as APT-Q-27), a cluster previously documented by Qi’anxin.

The infection chain remains consistent across campaigns. Initial access is typically achieved through phishing emails disguised as screenshots or support files, often routed through enterprise ticketing systems.

Victims execute a malicious binary that retrieves second-stage payloads from cloud infrastructure such as Alibaba OSS or Google Cloud Storage.

GoldenEyeDog Threat Group

The malware uses DLL sideloading via legitimate executables, including Tencent-signed binaries, to load a malicious DLL that decrypts an encrypted payload stored in a .log file.

This decrypted payload deploys the Golden Gh0st RAT implant in memory. Notably, the decryption routine has remained largely unchanged across samples since at least 2024, indicating operational stability.

Researchers have published decryption tooling and payload samples on GitHub (https://github.com/expel-io/expel-intel) and VirusTotal, enabling further analysis.

GoldenEyeDog’s operational infrastructure also demonstrates maturity. The RAT communicates over WebSocket rather than traditional TCP, using custom encrypted frames with hardcoded keys.

Command-and-control servers such as uu.goldeyeuu.io and api.keensie.com operate on uncommon ports like 5188 and 5198, with persistent heartbeat mechanisms and session-based command execution.

Post-exploitation capabilities are extensive. The malware can enumerate processes, exfiltrate browser credentials from Chrome, Firefox, and region-specific applications like QQ Browser, deploy persistence via scheduled tasks and BAT scripts, and erase forensic artifacts including Windows Event Logs.

A notable plugin, plugin32.dll, establishes persistence by creating a hidden administrative account and enabling automatic RDP login via registry modification.

The campaign aligns with broader trends in certificate abuse. Platforms like Cert Graveyard (https://certgraveyard.org/) have tracked over 75 certificates linked to Golden Gh0st Loader.

Similar tactics have been observed in operations involving Black Basta, Rhysida, and BaoLoader, highlighting code-signing abuse as a durable and scalable evasion method.

GoldenEyeDog’s evolution reflects a broader shift in cybercrime, where financially motivated groups increasingly adopt techniques once associated with nation-state actors.

As noted by researchers and industry experts, including discussions at Sleuthcon 2024, failure to recognize this convergence risks underestimating the threat and delaying effective response.

Indicators of compromise (IOCs)

Domain and port	Timeframe
uu.goldeyeuu.io:5188	December 1, 2025–June 9, 2026
wk.goldeyeuu.io:5188	January 18, 2026–June 7, 2026
api.keensie.com:5198	June 6, 2026–current

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide