GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

**Executive Summary:** Expel attributes the April 2026 DigiCert breach to CylindricalCanine, a sub-cluster of the Chinese state-linked APT GoldenEyeDog, which stole code-signing certificates from the Certificate Authority; the report details intrusion tradecraft (targeted phishing/exploited services, lateral movement, certificate exfiltration), explains the severe trust and detection implications for the software ecosystem, and provides defensive recommendations including certificate rotation, auditing CI/CD pipelines, and monitoring revocation status.