Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates

TL;DR

• In part one of this series, we discussed CylindricalCanine’s malware’s capabilities. CylindricalCanine is a subgroup of the Chinese cybercrime group GoldenEyeDog.
• GoldenEyeDog appears to have multiple subgroups, where we have visibility into two groups.
• We’ve tracked the second subgroup as CuboidalCanine (Expel-TA-0003). CuboidalCanine uses their own malware and code-signing certificates.
• Both of these teams heavily use code-signing certificates and appear to keep them separate to avoid negatively impacting the other’s campaign. However, there isn’t a perfect separation: over the years, these teams have shared the same tactics, and sometimes, the same code-signing certificates.

In part one of this blog series, we analyzed CylindricalCanine’s malware Golden Gh0st RAT. In April 2026, CylindricalCanine gained access to a support user’s device at DigiCert allowing them to intercept code-signing certificates intended for DigiCert customers. They used these certificates to sign their own Golden Gh0st Loader. Based on our analysis, GoldenEyeDog has separate teams with dedicated resources and targets, and these separate teams can be distinguished based on code-signing certificate usage and tactics. We’re tracking these two groups as CylindricalCanine (Expel-TA-0002) and CuboidalCanine (Expel-TA-0003). This blog, part two of the series, is dedicated to understanding their differences and diving into CuboidalCanine. 

Who is GoldenEyeDog? 

The Chinese cybersecurity company Qi’anxin has tracked and documented GoldenEyeDog since 2015. They understand GoldenEyeDog to be a large hacker group that targets individuals involved in gambling in Southeast Asia. They target both companies who manage gambling operations and criminals who blackmail individuals in gambling debt (these criminals are known as “dog pushers” 狗推). GoldenEyeDog is characterized as a persistent threat, with their sophistication being on-par with actors such as FIN6 and TA505. 

In investigating CylindricalCanine, we found their targeting of victims and behavior didn’t fully line-up with Qi’anxin’s description of GoldenEyeDog. Instead of targeting criminal groups, gambling organizations, and users, we found they targeted corporations. Instead of using watering holes, they use phishing with attachments. Yet we found they used identical tactics and malware described by Qi’anxin; tactics such as DLL side-loading to decrypt the next stage and a second stage Gh0st RAT variant with identical components as what was described in 2024. 

The link between the Cylindrical Canine and GoldenEyeDog as described in 2024 was made by Xiao Yin in an Alyin community post: the Golden Gh0st RAT payload contains hard-coded IP addresses that can be extracted. These hard-coded IP addresses were visible in malware from GoldenEyeDog in 2024 and can be extracted from the Golden Gh0st RAT samples from CylindricalCanine. (We made a version of Xiao Yi’s extraction script, available here.) Looking further back, vendors consistently documented GoldenEyeDog as using Gh0st RAT in 2023, 2022, and 2020. These factors and behaviors led us to confidently believe we were looking at the same malware and actors described by Qi’anxin over the years.

CuboidalCanine (Expel-TA-0003): GoldenEyeDog’s ValleyRAT favoring subgroup

At some point, a faction of GoldenEyeDog stopped using their custom Gh0st RAT and moved to using ValleyRAT. We’re tracking the faction using ValleyRAT as CuboidalCanine. In contrast to CylindricalCanine, CuboidalCanine targets the gambling industry, and still uses watering hole sites to distribute the malware.

ValleyRAT, also known as WinOS and SilverFox, was sold publicly on Telegram in 2023 and the builder has since been distributed on GitHub. This malware isn’t unique to any actor, but has been known to be used by GoldenEyeDog. Due to the source code being public, attribution of this malware to any actor relies on factors other than the malware family itself. We attribute this use of ValleyRAT malware to GoldenEyeDog based on their chosen lures, delivery attack chain, and code-signing certificate use. 

The use of code-signing certificates to bypass Windows SmartScreen is an important part of malware campaigns distributing EXE files. Threat actors that use code signing certificates tend to use them as a core tactic. Though GoldenEyeDog actors occasionally use other file formats that don’t require certificates, the use of certificates has been a consistent part of their campaigns. By tracing references back through publications, we found that their regular use of code-signing certificates goes back as far as 2017. Blackberry documented nine code-signing certificates used to sign an earlier version of their malware. Since 2024, we’ve identified 115 code-signing certificates attributed to the GoldenEyeDog actor group, but the subgroups, CylindricalCanine and CuboidalCanine, don’t share their certificates with each other for the most part.

A close inspection of CylindricalCanine and CuboidalCanine’s certificate usage 

The groups use distinct signing certificates. The overlaps appear to be either opsec failures or sourcing uniqueness failures. The groups have distinct, non-overlapping victimology.

The following diamond model diagrams summarize the core features of the groups. 

The full list of 115 code-signing certificates is available in the public database Cert Graveyard. Cert Graveyard tracks code-signing certificates used to sign malware, and includes instances where the same code-signing certificate is used to sign multiple malware, as this behavior can identify relationships between malware families and those distributing them. Since 2024, they’ve tracked 77 certificates used to sign Golden Gh0st Loader and 38 certificates to sign ValleyRAT. The majority of these ValleyRAT samples are believed to be signed by CuboidalCanine. Yet despite both groups being part of GoldenEyeDog, only four certificates are shared between the two malware families.

Threat actors obtain code-signing certificates by buying them from a criminal reseller. The reselling of code-signing certificates has been the primary way for cybercriminals to obtain certificates for years, as noted by a 2018 research paper. In regards to reselling certificates, buyers generally want to ensure the certificate is clean and only sold to one user, because negative reputation or revocation of the certificate due to misuse can affect their campaign. However, this exclusivity doesn’t always happen.

In regards to CylindricalCanine, we see sharing of certificates with CuboidalCanine as far back as the certificate mentioned by AnyRun in 2025: “Morning Leap & Cazo Electronics Technology Co.”. The payload discussed in that article uses the serial number 2686B9982E46DA7E3E0A1D56, which is used for several other files, including ValleyRAT disguised as a LetsVPN installer (LetsVPN is a common lure for GoldenEyeDog). 

In reviewing VirusTotal, we find that a separate certificate issued to the same organization—with a different serial number—was used to sign malware used by the Crazy Evil team masquerading as a component of various collaboration apps. Examples of these overlaps are in the table below:

In tracking this type of behavior, we can see that each group is obtaining certificates from a common source. This source, or reseller, obtains the certificates directly from a certificate provider (also known as a certificate authority) and resells them for use.

We see this shared source in two different scenarios. In the first scenario, the unknown reseller purchases certificates with the same organization name from multiple providers, and those certificates were used to sign multiple malware families. We’re confident these are from the same source because the reseller impersonating the organization used the same documentation in each application. We don’t have visibility as to whether this application is handled by the certificate providers themselves or an authorized reseller. 

In the second situation, only one certificate provider is used, but the reseller’s organization creates multiple certificates and those certificates—distinguished by different serial numbers—are used by multiple malware. In this situation, the reseller appears to be selling the certificate multiple times, but trying to avoid some contamination by minting multiple certificates.

What we see in the case of CylindricalCanine and CuboidalCanine is four times where they use the same certificate signer or certificate serial. These types of errors lead us to believe that both teams are buying from the same source (or they themselves are the source). The limited number of overlaps suggest that they attempt to keep separation between their use of certificates.

The following are the signers where both teams overlap:

In the case of the certificate issued to Weihai Mingjun Information Technology Co., Ltd., they share the same certificate signer, but different serial numbers.

In the case of RichQuest Network Technology Ltd., there is even a larger separation: they both obtained certificates with the same issuer, but from different code-signing providers. 

Certificates can be sold numerous times, and if they aren’t revoked, they can be sold to a wider array of actors or be used for multiple malware. In the case of 山西荣升源科贸有限公司 (Shanxi Rongshengyuan Science & Trade Co., Ltd.), a reseller seemingly sold use of the certificate to CylindricalCanine, CuboidalCanine, and one or two other actors.

Other malware families sharing GoldenEyeDog’s code-signing certificates 

As seen in two cases above, the use of the certificates isn’t limited to the two teams. Cert Graveyard documents that the malware certificates used by CylindricalCanine share certificate signers with six other malware:

• PlugX
• Cobalt Strike
• AsyncRAT
• Lumma Stealer
• GorelloRMM
• Fake crypto trading apps
• Loaders from the Crazy Evil team 

From this group, ValleyRAT, PlugX, and Golden Gh0st Loader are malware distinctly associated with Chinese cybercrime while others (Lumma infostealer, AsyncRAT, loaders from the Crazy Evil team) are associated with Russian cybercrime. The fake crypto trading apps are not clearly associated with any particular actor. The remaining items, CobaltStrike and GorelloRMM, are legitimate tools being signed and misused in cyber attacks, also not easily associated with any specific actor.

We don’t have reason to believe these other malware families are being used by GoldenEyeDog, but we do think they tell us the source of certificates seems to have buyers both in Russian and Chinese cybercrime circles. 

GoldenEyeDog’s certificate overlap with Crazy Evil

The most prominent of these other overlaps are with the Crazy Evil team. “Crazy Evil” is their self-selected name, and they specialize in social engineering and cryptocurrency theft. The Crazy Evil team uses code-signing certificates regularly to avoid warnings from SmartScreen.

Over the years, there have been three overlaps in certificate usage between the Crazy Evil team and CylindricalCanine. The following table shows three observed overlaps, which implies the same source is used for obtaining these certificates.

Of these three, GZ.PurestJone Network Technology Co., Ltd. is the most interesting. In this case, Crazy Evil used the certificate shortly after its issuance: the certificate was issued on April 11, 2024, and the malware was first seen on VirusTotal on April 26, 2024. The same serial number was then used by CylindricalCanine on April 8, 2025, and uploaded to VirusTotal, two days before it was due to expire.

Learning from GoldenEyeDog’s certificate use 

In analyzing code-signing certificates and malware, we identified two seemingly distinct groups of actors within GoldenEyeDog, which we’ve labeled CylindricalCanine and CuboidalCanine. These groups have shared tactics over the years, but seem to isolate their use of code-signing certificates, and working as independent teams within GoldenEyeDog. The actors seemingly buy their certificates from a common source that also supplies code-signing certificates to Russian cybercrime actors.

Recommendations

Actors regularly sign malware with code-signing signatures, so it’s important to have a means to block them. The primary method we recommend is using Windows Defender Application Control (WDAC). We’ve recently published on how WDAC can block vulnerable drivers, but WDAC can block untrusted certificates, too. WDAC blocks unsigned files by default but signed files are generally allowed if you use permissive settings, so it’s necessary to either whitelist known good files or actively blocklist known bad files. The Cert Graveyard’s database includes “to-be-signed” (TBS) hashes, which can be used by WDAC to block files based on the signature. 

Indicators of compromise (IOCs)

We have provided IOCs on GitHub: https://github.com/expel-io/expel-intel/blob/main/2026/07/GoldenEyeDog-IOC/GoldenEyeDog_file_indicators.csv 

The IOCs include all files on VirusTotal signed with the abused code-signing certificates. The IOC list includes 2,616 files that were signed with the 115 certificates used by CylindricalCanine and CuboidalCanine. 

References

https://ti.qianxin.com/apt/hacker-detail/5fbb87ef7579b60020f466c7

https://mp.weixin.qq.com/s/fZs-0mvk15Cime6IKysyvw

https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/

https://ti.qianxin.com/blog/articles/apt-q-27-gang-recent-use-of-silver-fox-trojan-stealing-activities-en/  

https://cystack.net/research/malware-linked-apt-q-27

https://xz.aliyun.com/news/90793 / https://www.ctfiot.com/286193.html 

https://medium.com/@anyrun/zhong-stealer-analysis-new-malware-targeting-fintech-and-cryptocurrency-71d4a3cce42c 

https://sect.iij.ad.jp/blog/2026/02/plugx-executed-via-staticplugin/ 

https://bluecyber.hashnode.dev/mustang-panda-x-plugx-analysis-of-the-january-2026-sample-a-multi-layer-execution-chain 

https://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247490831&idx=1&sn=54def291b6bd573186734895b7ed03b6&scene=21&poc_token=HAnxLmqj6fzzusOy8JhsMvEi3vzCFiUgSCEA-zWt 

https://mp.weixin.qq.com/s/gdb8KStXDxY2eOLLbiPFCQ 

https://asec.ahnlab.com/en/57185/