{"id":14426,"date":"2026-07-20T10:03:43","date_gmt":"2026-07-20T10:03:43","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/20\/goldeneyedog-hackers-group-behind-digicert-breach-that-hijacks-code-signing-certificates\/"},"modified":"2026-07-20T10:03:43","modified_gmt":"2026-07-20T10:03:43","slug":"goldeneyedog-hackers-group-behind-digicert-breach-that-hijacks-code-signing-certificates","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/20\/goldeneyedog-hackers-group-behind-digicert-breach-that-hijacks-code-signing-certificates\/","title":{"rendered":"GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates"},"content":{"rendered":"

GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

GoldenEyeDog, a Chinese cybercrime group linked to the Golden Gh0st malware family, is back in focus after an intrusion at DigiCert exposed the risks around code-signing certificates. <\/p>\n

The attackers used the access to intercept customer certificate activation codes and sign their own malicious files.<\/a><\/p>\n

The operation relied on a simple but effective route into a sensitive environment. <\/p>\n

Malicious files were disguised as screenshots, delivered through phishing emails or support-ticket submissions, and opened by staff who believed they were reviewing customer content.<\/a><\/p>\n

Expel said in a report<\/a> shared with Cyber Security News (CSN)\u00a0that the activity was carried out by a GoldenEyeDog subgroup it calls CylindricalCanine. <\/p>\n

Researchers linked the group to Golden Gh0st Loader and Golden Gh0st RAT, malware tools that have evolved through several campaigns since 2015.<\/p>\n

\n
\"Golden
Golden Gh0st RAT infection chain (Source \u2013 Expel)<\/figcaption><\/figure>\n<\/div>\n

The case also highlights a larger problem for defenders. A valid code-signing certificate can make a malicious program appear more trustworthy to Windows security checks, allowing attackers to gain an advantage before detection tools or users recognize the danger.<\/a><\/p>\n

GoldenEyeDog Hackers Group Behind DigiCert Breach<\/strong><\/h2>\n

The April 2026 breach began when a DigiCert support employee ran a malicious file received through the company\u2019s ticketing system. <\/p>\n

The compromised device gave the attackers access to initialization codes associated with customers renewing code-signing certificates.<\/a><\/p>\n

Those codes are used to activate the hardware tokens required for signing software. By stealing them, the attackers could intercept certificates intended for legitimate customers, then use them to sign malware that looked more credible to security controls. <\/p>\n

Earlier reporting on the\u00a0weaponized screensaver DigiCert breach<\/a>\u00a0documented how the incident involved malware previously tracked as Zhong Stealer.<\/p>\n

Expel\u2019s analysis indicates that the malware is more than an information stealer. Golden Gh0st RAT can give operators remote access, collect browser credentials, capture screenshots, list running processes, execute commands, and erase traces of activity from infected systems.<\/a><\/p>\n

The RAT also supports persistence, meaning it can remain active after a reboot. <\/p>\n

One observed plugin created a backdoor account with administrator privileges and altered system settings to enable remote desktop access, giving attackers another way to return to a compromised device.<\/a><\/p>\n

Loader Tactics and Detection<\/strong><\/h2>\n

Golden Gh0st Loader commonly uses DLL sideloading, a technique in which a legitimate Windows application is tricked into loading a malicious library placed beside it. The library then decrypts and loads the actual RAT from a file that may be disguised as a log file.<\/a><\/p>\n

That approach makes the infection chain harder to spot because trusted applications can be used as part of the execution process. <\/p>\n

\n
\"Qi\u2019anxin\u2019s
Qi\u2019anxin\u2019s depiction of the infection chain associated with GoldenEyeDog\u2019s watering hole lures (Source \u2013 Expel)<\/figcaption><\/figure>\n<\/div>\n

Similar abuse has appeared in the\u00a0recent AsyncRAT sideloading campaign<\/a>, where attackers hid malicious activity behind apparently normal software components.<\/p>\n

In the recent campaign, the loader retrieved additional files from cloud-hosted locations, including a legitimate executable, supporting runtime files, a malicious DLL, an encrypted payload, and decoy documents. <\/p>\n

A fake image or PDF displaying a 503 error helped make the activity appear less suspicious to victims.<\/a><\/p>\n

Golden Gh0st RAT communicates with its command-and-control servers through unencrypted WebSocket connections, while encrypting the content inside those connections. <\/p>\n

Analysts observed the malware using low-numbered ports 5188 and 5198, which can help defenders investigate unusual outbound traffic.<\/a><\/p>\n

Security teams should closely validate attachments and download links submitted through support portals, especially files presented as screenshots or customer evidence. <\/p>\n

Staff handling tickets should use isolated review systems where possible and verify unexpected files through a separate channel before opening them.<\/p>\n

Defenders should also watch for suspicious DLLs loaded by legitimate applications, unexpected scheduled tasks, new local administrator accounts, and outbound WebSocket traffic to the listed domains. <\/p>\n

Monitoring for the\u00a0encrypted RAT command traffic<\/a>\u00a0and applying network detections for Golden Gh0st\u2019s distinctive communications can improve the chance of catching the activity early.<\/p>\n

Indicators of compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
File name<\/td>\n20241224.exe<\/code><\/td>\nFirst-stage executable, presented as a photo-themed file<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/kkuu.oss-cn-hongkong.aliyuncs.com\/ss\/uu.txt<\/code><\/td>\nConfiguration file URL used by the 2025 loader<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/kkuu.oss-cn-hongkong.aliyuncs.com\/ss\/down.exe<\/code><\/td>\nSecond-stage executable download<\/td>\n<\/tr>\n
File name<\/td>\ndown.exe<\/code><\/td>\nDownloaded executable used in the 2025 infection chain<\/td>\n<\/tr>\n
SHA-256<\/td>\n4eaebd93e23be3427d4c1349d64bef4b5fc455c93aebb9b5b752981e9266488e<\/code><\/td>\nHash for\u00a0down.exe<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/kkuu.oss-cn-hongkong.aliyuncs.com\/ss\/TASLoginBase.dll<\/code><\/td>\nMalicious DLL download<\/td>\n<\/tr>\n
File name<\/td>\nTASLoginBase.dll<\/code><\/td>\nDLL used for sideloading<\/td>\n<\/tr>\n
SHA-256<\/td>\n1abffe97aafe9916b366da57458a78338598cab9742c2d9e03e4ad0ba11f29bf<\/code><\/td>\nHash for\u00a0TASLoginBase.dll<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/kkuu.oss-cn-hongkong.aliyuncs.com\/ss\/TASLogin.log<\/code><\/td>\nEncrypted RAT payload download<\/td>\n<\/tr>\n
File name<\/td>\nTASLogin.log<\/code><\/td>\nEncrypted payload loaded by the sideloaded DLL<\/td>\n<\/tr>\n
SHA-256<\/td>\ndd44dabff536a1aa9b845dd891ad483162d4f28913344c93e5d59f648a186098<\/code><\/td>\nHash for\u00a0TASLogin.log<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/as.txt<\/code><\/td>\nConfiguration file URL used in the June 2026 campaign<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/updat.exe<\/code><\/td>\nLegitimate executable used for sideloading<\/td>\n<\/tr>\n
File name<\/td>\nupdat.exe<\/code><\/td>\nLegitimate executable used to load the malicious DLL<\/td>\n<\/tr>\n
SHA-256<\/td>\n2b0071007c3f5fa8e949a8de53be03e97901dd505694ca939b575a49e4fdbdbb<\/code><\/td>\nHash for\u00a0updat.exe<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/vcruntime140.dll<\/code><\/td>\nRuntime library download<\/td>\n<\/tr>\n
File name<\/td>\nvcruntime140.dll<\/code><\/td>\nLegitimate Microsoft runtime<\/td>\n<\/tr>\n
SHA-256<\/td>\n8e08575492175e042f093f325b07a5c14ca71e7c581474838db3d48f5aab1312<\/code><\/td>\nHash for\u00a0vcruntime140.dll<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/msvcp140.dll<\/code><\/td>\nRuntime library download<\/td>\n<\/tr>\n
File name<\/td>\nmsvcp140.dll<\/code><\/td>\nLegitimate Microsoft runtime<\/td>\n<\/tr>\n
SHA-256<\/td>\ne4c71980dbb4a1e1a86816687afdaea043b639b531135fc4516fb2429fe623fc<\/code><\/td>\nHash for\u00a0msvcp140.dll<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/crashreport.dll<\/code><\/td>\nMalicious DLL download<\/td>\n<\/tr>\n
File name<\/td>\ncrashreport.dll<\/code><\/td>\nMalicious DLL used for sideloading<\/td>\n<\/tr>\n
SHA-256<\/td>\n27b722c66f69e360c4da106daacf3b9eeaabd20634d7e5eff45a28bd70ebfd65<\/code><\/td>\nHash for\u00a0crashreport.dll<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/updat.log<\/code><\/td>\nEncrypted payload download<\/td>\n<\/tr>\n
File name<\/td>\nupdat.log<\/code><\/td>\nEncrypted payload loaded into memory<\/td>\n<\/tr>\n
SHA-256<\/td>\n3313f347e83aaf48ea31fb1d49fc37452f48f81d20a1b93009e2e78385ff4bba<\/code><\/td>\nHash for\u00a0updat.log<\/code>\n<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/image.jpg<\/code><\/td>\nDecoy JPEG URL<\/td>\n<\/tr>\n
File name<\/td>\nimage.jpg<\/code><\/td>\nDecoy file displaying a 503 error<\/td>\n<\/tr>\n
URL<\/td>\nhxxps:\/\/storage.googleapis.com\/kiki001\/newimage.pdf<\/code><\/td>\nDecoy PDF URL<\/td>\n<\/tr>\n
File name<\/td>\nnewimage.pdf<\/code><\/td>\nDecoy PDF containing a 503-error image<\/td>\n<\/tr>\n
SHA-256<\/td>\nf67de637fca127212dc60b9a02f74e66dbd602b3b9f6f6e4f2b75614c1f9e944<\/code><\/td>\nHash for\u00a0newimage.pdf<\/code>\n<\/td>\n<\/tr>\n
SHA-256<\/td>\n81e276aaa3eb9b3f595663c316b3c6414cc3dde5e6cc3a82856b7276acabb7de<\/code><\/td>\nGolden Gh0st RAT sample observed April 12, 2026<\/td>\n<\/tr>\n
Domain and port<\/td>\nuu.goldeyeuu.io:5188<\/code><\/td>\nGolden Gh0st RAT command-and-control server<\/td>\n<\/tr>\n
Domain and port<\/td>\nwk.goldeyeuu.io:5188<\/code><\/td>\nGolden Gh0st RAT command-and-control server<\/td>\n<\/tr>\n
Domain and port<\/td>\napi.keensie.com:5198<\/code><\/td>\nGolden Gh0st RAT command-and-control server<\/td>\n<\/tr>\n
File name<\/td>\nplugin32.dll<\/code><\/td>\nPersistence plugin that deploys an RDP backdoor<\/td>\n<\/tr>\n
SHA-256<\/td>\nd1b1938963037aa332591a4c999523a05886d1f62d80e03f0adc22630b8671c4<\/code><\/td>\nHash for the decrypted and unpacked\u00a0plugin32.dll<\/code>\u00a0payload<\/td>\n<\/tr>\n
Encryption key<\/td>\n8A913610E905C3DD1F657811EA3B1933471B230F88E1C155616099A03AB0ABC0<\/code><\/td>\nHardcoded Golden Gh0st RAT\u00a0REGISTERKEY<\/code>\n<\/td>\n<\/tr>\n
Encryption key<\/td>\n2031A71C399563ADAF1572E10ABB395387EB132208A001C5E140496D7A3E0B26<\/code><\/td>\nHardcoded Golden Gh0st RAT\u00a0MODULEKEY<\/code>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0->\u00a0Integrate ANY.RUN With Your SOC\u00a0<\/a>Now<\/a><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

GoldenEyeDog Hackers Group Behind DigiCert Breach that Hijacks Code-Signing Certificates GoldenEyeDog, a Chinese cybercrime group linked to the Golden Gh0st malware family, is back in focus after an intrusion at DigiCert exposed the risks around code-signing certificates. The attackers used the access to intercept customer certificate activation codes and sign their own malicious files. The […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-14426","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14426"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=14426"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/14426\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=14426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=14426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=14426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}