Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident

This report analyzes Golden Gh0st Loader and Golden Gh0st RAT operated by CylindricalCanine (a subgroup of GoldenEyeDog), detailing phishing and DLL sideloading infection chains, modular RAT capabilities (credential theft, keylogging, RDP backdoor, persistence, anti-forensics), custom WebSocket C2 protocol and hardcoded keys, domains/IOCs, and an April 2026 supply-chain impact where attackers accessed a DigiCert support machine to steal code-signing initialization codes and use DigiCert-signed malware to evade SmartScreen.