Reading the certificate leaves: Understanding GoldenEyeDog’s teams—CylindricalCanine and CuboidalCanine—through code-signing certificates

This report analyzes GoldenEyeDog and two distinct subgroups (CylindricalCanine and CuboidalCanine), detailing their use of Golden Gh0st RAT and ValleyRAT, systematic abuse of code-signing certificates (115 certificates, 2,616 signed files), evidence of a DigiCert support-user compromise to intercept certificates, overlap with other criminal actors via certificate resellers, and recommended mitigations (e.g., Windows Defender Application Control and blocklisting TBS hashes).