GoldenEyeDog Threat Group Behind DigiCert Code-Signing Certificate Attack

**Executive summary:** GoldenEyeDog (aka APT-Q-27) conducted a sophisticated intrusion into DigiCert in April 2026 to intercept certificate initialization codes and abuse legitimate code-signing certificates to sign Golden Gh0st Loader/RAT payloads, enabling evasion of Windows SmartScreen and trusted distribution; the campaign leverages DLL sideloading, WebSocket-based C2, modular RAT plugins for credential theft, persistence and RDP backdoors, and persistent infrastructure (e.g., uu.goldeyeuu.io:5188, api.keensie.com:5198).