Loading threat actor…
CylindricalCanine is a threat activity cluster assessed to be a subgroup of the Chinese cybercrime group GoldenEyeDog, also tracked as APT-Q-27, Dragon Breath, and Miuuti Group. The subgroup has been linked to campaigns centered on Golden Gh0st Loader and Golden Gh0st RAT, a modified Gh0st RAT variant, and is distinguished from other GoldenEyeDog subgroups by its focus on corporate victims rather than the gambling-focused operations associated with other parts of the broader cluster. CylindricalCanine is known for abusing code-signing certificates as a core operational enabler. In April 2026, the subgroup was attributed to the compromise of DigiCert support workstations after a malicious file disguised as a screenshot was delivered through customer support channels. Access to the support environment enabled theft of certificate initialization codes and interception of code-signing certificates intended for legitimate customers, which were then used to sign the actor’s malware. This certificate abuse supported defense evasion by making malicious binaries appear more trustworthy to Windows security controls. Its delivery tradecraft commonly relies on phishing lures and malicious files masquerading as screenshots or similar benign documents. Observed infection chains use legitimate executables to trigger DLL sideloading of malicious libraries, which decrypt and load encrypted Golden Gh0st payloads while displaying decoy content to reduce suspicion. Golden Gh0st RAT supports full remote access, command execution, process enumeration, screenshot capture, keylogging, credential theft, SOCKS proxying, payload delivery, persistence, and anti-forensic actions such as clearing event logs. Observed plugins have also enabled creation of administrator-level backdoor accounts and remote desktop access. The subgroup has shown sustained use of abused or stolen code-signing certificates since at least 2024 and appears operationally distinct within GoldenEyeDog, although certificate overlap with other GoldenEyeDog activity suggests a shared certificate source or procurement channel. High-confidence targeting includes corporations and finance-related organizations in the Asia-Pacific region.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
28 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A GoldenEyeDog subgroup that targets corporations and uses phishing attachments rather than watering holes. It uses Golden Gh0st malware and heavily abuses code-signing certificates, including intercepted DigiCert customer certificates, to sign loaders and payloads.
Named subgroup of GoldenEyeDog that Expel attributes as carrying out the DigiCert-related activity.
Threat activity cluster tied to the April 2026 DigiCert compromise. It abused customer chat/social engineering to deliver a malicious payload, compromised DigiCert support analyst workstations, intercepted code-signing certificate initialization codes, fraudulently obtained certificates, and used them to sign malware. Its operations also include phishing with screenshot-themed lures, DLL side-loading, and deployment of Golden Gh0st RAT.
A distinct operational sub-group within GoldenEyeDog that uses Golden Gh0st Loader and Golden Gh0st RAT in phishing and support-portal submission campaigns, including targeting finance organizations in the Asia Pacific region and activity linked to the DigiCert certificate theft incident.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.