GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine. Expel, which shared technical details of the event, described the threat actor as a sub-group of GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group known for its targeting of the gambling and gaming sectors using

The article reports that a subgroup of the Chinese cybercrime organization GoldenEyeDog, tracked as CylindricalCanine, breached DigiCert’s internal support environment in April 2026 via a phishing attack using a malicious file disguised as a screenshot, then stole and abused Extended Validation code-signing certificates to sign their own malware and evade detection.[1][2][5][7][8] These stolen certificates were used to issue fraudulent certs in the names of real DigiCert customers and to sign malware such as Zhong Stealer, undermining trust in software and certificate-based security controls.[5][8] From a RealGround perspective, any AI system that relies on signed binaries, trusted SDKs, or certificate-based integrity checks inherits this kind of supply-chain risk: compromised code-signing undermines assumptions about the safety of AI infrastructure, model-serving components, and third-party libraries. Organizations should treat code-signing and certificate management as critical elements of their AI supply chain, introduce SBOM-driven verification and automated certificate integrity monitoring, and regularly red-team AI environments to detect malicious but correctly signed compone