DigiCert Breach (April 2026)

In April 2026, DigiCert — one of the world's largest Certificate Authorities (CAs) — suffered a security incident in which attackers stole code-signing certificates intended for customers.

Timeline

Attribution

Expel researchers attributed the incident to Cylindrical Canine, a subgroup of the Chinese cybercrime group GoldenEyeDog (APT-Q-27). (raw/digests/Cyber-Digest-2026-07-18)

Tactics

• Attackers used a modified Gh0st RAT to compromise a DigiCert support member's device
• Stole code-signing certificates that were intended for DigiCert customers
• The breach targeted the CA's internal support infrastructure, not the certificate issuance pipeline itself

Significance

Code-signing certificate theft from a major CA enables threat actors to sign malware with trusted certificates, bypassing OS and security software trust checks. This represents a supply chain attack at the internet trust infrastructure layer.

Related Pages

• Cylindrical Canine — The threat actor subgroup attributed to the breach
• Intellexa Predator — Another trust/espionage supply chain (spyware)
• Progress Software — Software supply chain incidents (MOVEit, etc.)

Note: DigiCert has not independently confirmed the attribution. This assessment is based solely on Expel's research (Tier 2 source).