How a GoldenEyeDog Subgroup Stole DigiCert's Code-Signing Certificates

Robert Moore · 2026-07-17

### The DigiCert Breach: A New Threat Actor Emerges Cybersecurity researchers have officially tied the April 2026 DigiCert security incident to a new threat activity cluster called CylindricalCanine. This isn't just another data breach. It's a targeted attack that compromised code-signing certificates, which are critical for verifying software authenticity. Think of code-signing certificates like a digital seal of approval. When you download software, these certificates assure you it hasn't been tampered with. If hackers get their hands on them, they can make malicious software look legitimate. That's exactly what happened here. Expel, the cybersecurity firm that shared technical details of the event, described CylindricalCanine as a sub-group of GoldenEyeDog. You might know GoldenEyeDog by its other aliases: APT-Q-27, Dragon Breath, or Miuuti Group. This is a Chinese cybercrime group with a long history of targeting the gambling and gaming sectors. ### Who Is GoldenEyeDog? GoldenEyeDog has been active for years, primarily focusing on stealing credentials and financial data from online casinos and gaming platforms. They use sophisticated phishing campaigns and social engineering tactics to gain access to their targets. But this DigiCert attack marks a shift. By going after a certificate authority, they're moving up the food chain. Instead of targeting individual companies, they're going after the infrastructure that many companies trust. Here's what makes this group dangerous: - **They're patient.** Their attacks often involve long-term reconnaissance before striking. - **They adapt quickly.** When security patches come out, they find new vulnerabilities to exploit. - **They're well-funded.** This isn't a small-time operation. They have resources to develop custom tools. ### What CylindricalCanine Did Differently CylindricalCanine didn't just break into DigiCert's network. They specifically targeted the systems that issue code-signing certificates. This required a deep understanding of DigiCert's internal processes and security measures. "This wasn't a smash-and-grab," one security analyst noted. "This was a surgical strike." The attackers likely used stolen credentials from a previous phishing campaign to gain initial access. From there, they moved laterally through the network, eventually reaching the certificate issuance systems. Once they had control, they could issue fraudulent certificates that would pass all standard verification checks. Any software signed with these certificates would appear trustworthy to users and security software alike. ### The Real-World Impact For businesses, this breach has serious implications. If you're a software developer or a company that relies on code signing, you need to be aware that some of your certificates may have been compromised. DigiCert has already revoked the affected certificates, but the damage may already be done. Attackers could have used these certificates to sign malware that's now circulating in the wild. Here's what you should do right now: - **Check your certificates.** Verify that any code-signing certificates you use were issued before the breach was discovered. - **Monitor for suspicious software.** Look for software signed with certificates that DigiCert has revoked. - **Update your security policies.** Consider implementing additional verification steps for software downloads. ### How to Protect Your Organization This attack highlights the importance of layered security. No single defense can stop a determined attacker. You need multiple layers of protection. Start with strong access controls. Limit who can access critical systems like certificate issuance. Use multi-factor authentication everywhere you can. Next, implement monitoring and detection systems. If an attacker does gain access, you want to know about it as quickly as possible. Look for unusual patterns in network traffic or system behavior. Finally, have an incident response plan in place. When a breach happens, you need to act fast. Know who to contact and what steps to take before the crisis occurs. ### The Bigger Picture The CylindricalCanine attack is a reminder that cyber threats are constantly evolving. Attackers are always looking for new ways to bypass security measures. Certificate authorities are now a prime target. "We're seeing a trend where attackers go after the trust infrastructure," explained a cybersecurity researcher. "If you can compromise the systems that everyone trusts, you can compromise everyone." This means that even if your own security is rock solid, you're still at risk if the services you depend on get compromised. It's a sobering thought, but it's the reality of today's threat landscape. To stay safe, you need to stay informed. Keep up with the latest security news and adjust your defenses accordingly. And always verify before you trust.