CylindricalCanine / GoldenEyeDog DigiCert Code-Signing Certificate Theft

Technical Analysis

The DigiCert breach reportedly enabled the attackers to obtain valid code-signing certificates, which threat actors typically use to digitally sign malicious binaries so they bypass application whitelisting, SmartScreen/Gatekeeper heuristics, and endpoint detection trust checks. GoldenEyeDog/Dragon Breath has historically used DLL side-loading and trojanized installers targeting the gambling and gaming sectors, and stolen certificates would materially increase the credibility and stealth of such payloads. Because signed malicious packages or installers can be distributed through legitimate-looking update channels, any organization that pulls signed binaries, SDKs, or plugins into automated build or deployment pipelines is at risk of unknowingly trusting compromised code. If compromised certificates are used to sign malicious packages that get pulled into agent orchestration frameworks, MLOps tooling, or CI/CD pipelines that provision AI agents, this could result in silent execution of trojanized code with access to API keys, model weights, and agent credentials stored on the host.

Affected Systems

Systems relying on DigiCert-issued code-signing certificates for software trust validation; Windows/macOS endpoints that validate signed executables and installers; software supply chains and update mechanisms that trust DigiCert-signed binaries

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in available reporting; attributed cluster name: CylindricalCanine; associated actor aliases: GoldenEyeDog, APT-Q-27, Dragon Breath, Miuuti Group

Remediation Steps

1. 1

   Revoke and reissue certificates

   Work with DigiCert to identify and revoke any certificates confirmed or suspected to be compromised, and reissue new certificates with updated private key protections.

2. 2

   Audit signed binaries

   Inventory and re-verify signatures on all software signed with potentially affected DigiCert certificates, cross-referencing against known-good hashes and vendor advisories.

3. 3

   Enhance code-signing validation

   Implement additional integrity checks beyond signature trust alone, such as hash allowlisting, SBOM verification, and behavioral analysis for newly signed executables.

4. 4

   Monitor CI/CD and agent deployment pipelines

   Review automated build, package, and agent-provisioning pipelines for unexpected signed dependencies or updates, and restrict trust to verified publishers only.

5. 5

   Threat hunt for GoldenEyeDog TTPs

   Search for indicators associated with DLL side-loading, trojanized installers, and known GoldenEyeDog/Dragon Breath infrastructure across endpoints and network logs.