A recent cyberattack on DigiCert, a leading certificate authority, has been attributed to the Chinese cybercrime group known as GoldenEyeDog. This group, linked to the Golden Gh0st malware family, exploited DigiCert’s systems to intercept customer certificate activation codes, enabling them to sign malicious files with legitimate credentials.
The breach commenced in April 2026 when a DigiCert support employee inadvertently executed a malicious file received through the company’s ticketing system. This action granted the attackers access to initialization codes associated with customers renewing code-signing certificates. These codes are crucial for activating hardware tokens used in software signing. By intercepting them, the attackers could sign malware, making it appear trustworthy to security systems.
GoldenEyeDog’s tactics involved disguising malicious files as screenshots, delivered via phishing emails or support-ticket submissions. Unsuspecting staff members, believing they were reviewing legitimate customer content, opened these files, thereby facilitating the breach.
Expel, a cybersecurity firm, identified a subgroup within GoldenEyeDog, referred to as CylindricalCanine, as the perpetrators. This subgroup is associated with the Golden Gh0st Loader and Golden Gh0st RAT malware tools, which have been active in various campaigns since 2015. The Golden Gh0st RAT provides remote access, collects browser credentials, captures screenshots, lists running processes, executes commands, and can erase traces of its activity. It also supports persistence, allowing it to remain active after system reboots. Notably, one plugin observed created a backdoor account with administrative privileges and modified system settings to enable remote desktop access, providing attackers with another avenue to control compromised devices.
The attackers employed DLL sideloading, a technique where a legitimate Windows application is tricked into loading a malicious library placed alongside it. This method complicates detection, as trusted applications are used in the execution process. The malicious library decrypts and loads the actual RAT from a file that may be disguised as a log file.
This incident underscores the critical importance of securing code-signing certificates. When compromised, these certificates can be used to sign malicious programs, making them appear legitimate and trustworthy to both users and security systems. Organizations must implement stringent security measures to protect these certificates and educate employees on recognizing and avoiding phishing attempts to prevent similar breaches.
As cyber threats continue to evolve, it is imperative for companies to stay vigilant and adopt comprehensive security strategies. This includes regular audits of security protocols, employee training on cybersecurity best practices, and the implementation of advanced threat detection systems. The DigiCert breach serves as a stark reminder of the potential consequences of lapses in cybersecurity and the need for continuous improvement in defense mechanisms.
