INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

DigiCert Breach Linked to GoldenEyeDog Subgroup Code-Signing Certificate Theft

| 2026-07-17 16:39 MEDIUM HIGH DATA BREACH
JSON
Executive Summary
AI-generated
In April 2026, a Chinese cybercrime group known as GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group) linked to the DigiCert security incident used malware to access a support member's device at DigiCert, a code-signing certificate provider. The attackers targeted finance organizations in the Asia-Pacific region using malware consistent with other Chinese cybercrime activity. Golden Gh0st RAT, a modified version of Farfli, was delivered via Golden Gh0st Loader and shared behavioral and tactical overlaps with previously detected malware such as Zhong Stealer and QiAnXin's 2020 payload. The attackers abused code-signing certificates to gain unauthorized access to DigiCert customers' intended certificates and sign their own malware to avoid detection.
Technical Mitigations AI-generated
• Patch the Golden Gh0st RAT vulnerability in NSIS installers to prevent exploitation by CylindricalCanine. • Block or hunt for suspicious links sent via customer support chat channels, as observed in a multi-stage attack directed at Web3 companies earlier this year. • Monitor code-signing certificate abuse and revoke certificates issued by compromised internal support portals, such as the 60 certificates revoked by DigiCert after gaining unauthorized access to their internal support portal.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
up•••••.log
an•••••.run
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Black BastaBlack Basta
Target & Sectors
APAC APAC financefinance mediamedia
Incident Timeline
‎2026/07/17
Threat actors linked to GoldenEyeDog used their capabilities to target Windows on July 17, 2026.
infrastructure Windows
…of capabilities to set up persistence, steal sensitive data, start a SOCKS proxy tunnel, suppress display output, log keystrokes, take screenshots, enumerate processes, execute shell commands, drop additional payloads, and clear Windows Event logs.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
…of capabilities to set up persistence, steal sensitive data, start a SOCKS proxy tunnel, suppress display output, log keystrokes, take screenshots, enumerate processes, execute shell commands, drop additional payloads, and clear Windows Event logs.
Intelligence Sources
The Hacker News 2026-07-17