GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates

GoldenEyeDog, a Chinese cybercrime group linked to the Golden Gh0st malware family, is back in focus after an intrusion at DigiCert exposed the risks around code-signing certificates.

The attackers used the access to intercept customer certificate activation codes and sign their own malicious files.

The operation relied on a simple but effective route into a sensitive environment.

Malicious files were disguised as screenshots, delivered through phishing emails or support-ticket submissions, and opened by staff who believed they were reviewing customer content.

Expel said in a report shared with Cyber Security News (CSN) that the activity was carried out by a GoldenEyeDog subgroup it calls CylindricalCanine.

Researchers linked the group to Golden Gh0st Loader and Golden Gh0st RAT, malware tools that have evolved through several campaigns since 2015.

The case also highlights a larger problem for defenders. A valid code-signing certificate can make a malicious program appear more trustworthy to Windows security checks, allowing attackers to gain an advantage before detection tools or users recognize the danger.

GoldenEyeDog Hackers Group Behind DigiCert Breach

The April 2026 breach began when a DigiCert support employee ran a malicious file received through the company’s ticketing system.

The compromised device gave the attackers access to initialization codes associated with customers renewing code-signing certificates.

Those codes are used to activate the hardware tokens required for signing software. By stealing them, the attackers could intercept certificates intended for legitimate customers, then use them to sign malware that looked more credible to security controls.

Earlier reporting on the weaponized screensaver DigiCert breach documented how the incident involved malware previously tracked as Zhong Stealer.

Expel’s analysis indicates that the malware is more than an information stealer. Golden Gh0st RAT can give operators remote access, collect browser credentials, capture screenshots, list running processes, execute commands, and erase traces of activity from infected systems.

The RAT also supports persistence, meaning it can remain active after a reboot.

One observed plugin created a backdoor account with administrator privileges and altered system settings to enable remote desktop access, giving attackers another way to return to a compromised device.

Loader Tactics and Detection

Golden Gh0st Loader commonly uses DLL sideloading, a technique in which a legitimate Windows application is tricked into loading a malicious library placed beside it. The library then decrypts and loads the actual RAT from a file that may be disguised as a log file.

That approach makes the infection chain harder to spot because trusted applications can be used as part of the execution process.

Similar abuse has appeared in the recent AsyncRAT sideloading campaign, where attackers hid malicious activity behind apparently normal software components.

In the recent campaign, the loader retrieved additional files from cloud-hosted locations, including a legitimate executable, supporting runtime files, a malicious DLL, an encrypted payload, and decoy documents.

A fake image or PDF displaying a 503 error helped make the activity appear less suspicious to victims.

Golden Gh0st RAT communicates with its command-and-control servers through unencrypted WebSocket connections, while encrypting the content inside those connections.

Analysts observed the malware using low-numbered ports 5188 and 5198, which can help defenders investigate unusual outbound traffic.

Security teams should closely validate attachments and download links submitted through support portals, especially files presented as screenshots or customer evidence.

Staff handling tickets should use isolated review systems where possible and verify unexpected files through a separate channel before opening them.

Defenders should also watch for suspicious DLLs loaded by legitimate applications, unexpected scheduled tasks, new local administrator accounts, and outbound WebSocket traffic to the listed domains.

Monitoring for the encrypted RAT command traffic and applying network detections for Golden Gh0st’s distinctive communications can improve the chance of catching the activity early.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	20241224.exe	First-stage executable, presented as a photo-themed file
URL	hxxps://kkuu.oss-cn-hongkong.aliyuncs.com/ss/uu.txt	Configuration file URL used by the 2025 loader
URL	hxxps://kkuu.oss-cn-hongkong.aliyuncs.com/ss/down.exe	Second-stage executable download
File name	down.exe	Downloaded executable used in the 2025 infection chain
SHA-256	4eaebd93e23be3427d4c1349d64bef4b5fc455c93aebb9b5b752981e9266488e	Hash for down.exe
URL	hxxps://kkuu.oss-cn-hongkong.aliyuncs.com/ss/TASLoginBase.dll	Malicious DLL download
File name	TASLoginBase.dll	DLL used for sideloading
SHA-256	1abffe97aafe9916b366da57458a78338598cab9742c2d9e03e4ad0ba11f29bf	Hash for TASLoginBase.dll
URL	hxxps://kkuu.oss-cn-hongkong.aliyuncs.com/ss/TASLogin.log	Encrypted RAT payload download
File name	TASLogin.log	Encrypted payload loaded by the sideloaded DLL
SHA-256	dd44dabff536a1aa9b845dd891ad483162d4f28913344c93e5d59f648a186098	Hash for TASLogin.log
URL	hxxps://storage.googleapis.com/kiki001/as.txt	Configuration file URL used in the June 2026 campaign
URL	hxxps://storage.googleapis.com/kiki001/updat.exe	Legitimate executable used for sideloading
File name	updat.exe	Legitimate executable used to load the malicious DLL
SHA-256	2b0071007c3f5fa8e949a8de53be03e97901dd505694ca939b575a49e4fdbdbb	Hash for updat.exe
URL	hxxps://storage.googleapis.com/kiki001/vcruntime140.dll	Runtime library download
File name	vcruntime140.dll	Legitimate Microsoft runtime
SHA-256	8e08575492175e042f093f325b07a5c14ca71e7c581474838db3d48f5aab1312	Hash for vcruntime140.dll
URL	hxxps://storage.googleapis.com/kiki001/msvcp140.dll	Runtime library download
File name	msvcp140.dll	Legitimate Microsoft runtime
SHA-256	e4c71980dbb4a1e1a86816687afdaea043b639b531135fc4516fb2429fe623fc	Hash for msvcp140.dll
URL	hxxps://storage.googleapis.com/kiki001/crashreport.dll	Malicious DLL download
File name	crashreport.dll	Malicious DLL used for sideloading
SHA-256	27b722c66f69e360c4da106daacf3b9eeaabd20634d7e5eff45a28bd70ebfd65	Hash for crashreport.dll
URL	hxxps://storage.googleapis.com/kiki001/updat.log	Encrypted payload download
File name	updat.log	Encrypted payload loaded into memory
SHA-256	3313f347e83aaf48ea31fb1d49fc37452f48f81d20a1b93009e2e78385ff4bba	Hash for updat.log
URL	hxxps://storage.googleapis.com/kiki001/image.jpg	Decoy JPEG URL
File name	image.jpg	Decoy file displaying a 503 error
URL	hxxps://storage.googleapis.com/kiki001/newimage.pdf	Decoy PDF URL
File name	newimage.pdf	Decoy PDF containing a 503-error image
SHA-256	f67de637fca127212dc60b9a02f74e66dbd602b3b9f6f6e4f2b75614c1f9e944	Hash for newimage.pdf
SHA-256	81e276aaa3eb9b3f595663c316b3c6414cc3dde5e6cc3a82856b7276acabb7de	Golden Gh0st RAT sample observed April 12, 2026
Domain and port	uu.goldeyeuu.io:5188	Golden Gh0st RAT command-and-control server
Domain and port	wk.goldeyeuu.io:5188	Golden Gh0st RAT command-and-control server
Domain and port	api.keensie.com:5198	Golden Gh0st RAT command-and-control server
File name	plugin32.dll	Persistence plugin that deploys an RDP backdoor
SHA-256	d1b1938963037aa332591a4c999523a05886d1f62d80e03f0adc22630b8671c4	Hash for the decrypted and unpacked plugin32.dll payload
Encryption key	8A913610E905C3DD1F657811EA3B1933471B230F88E1C155616099A03AB0ABC0	Hardcoded Golden Gh0st RAT REGISTERKEY
Encryption key	2031A71C399563ADAF1572E10ABB395387EB132208A001C5E140496D7A3E0B26	Hardcoded Golden Gh0st RAT MODULEKEY

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.