Introducing CylindricalCanine: GoldenEyeDog Subgroup April DigiCert Incident

CylindricalCanine is a sophisticated Chinese threat actor subgroup within the larger GoldenEyeDog (APT-Q-27) cluster. This group gained significant notoriety in April 2026 after compromising a support member's device at DigiCert, a major certificate authority. The breach allowed the actors to steal initialization codes for code-signing certificates, which were subsequently used to sign their own malware to bypass Windows SmartScreen protections.

The group's primary toolkit consists of Golden Gh0st Loader and Golden Gh0st RAT, a highly modified version of the legacy Gh0st RAT. Their attack chain typically involves phishing emails or support ticket submissions containing links to malicious archives. They utilize DLL sideloading through legitimate binaries to decrypt and execute their final payloads, which are often hosted on public cloud infrastructure (Aliyun, Google Cloud).

CylindricalCanine remains a high-priority threat for financial institutions and critical infrastructure providers, particularly in the Asia-Pacific region. Their ability to weaponize legitimate certificate issuance processes represents a significant elevation in tradecraft beyond typical cybercriminal operations.