Expel warns of cyber gang targeting certificate trust

Expel has published research on a cybercrime subgroup it calls CylindricalCanine, which targets financial organisations in Asia Pacific and digital trust infrastructure.

The research links CylindricalCanine to a broader cluster known as GoldenEyeDog, tracked by Chinese security firm Qi'anxin. Expel assigned a separate name to distinguish the activity it has directly observed from the wider group.

According to the findings, the subgroup uses modified remote access trojans based on the long-running Gh0st RAT malware family. The attackers deploy a two-stage chain comprising Golden Gh0st Loader and Golden Gh0st RAT, with the loader delivering the main backdoor after the initial compromise.

The intrusion routes described in the research include phishing emails and submissions through customer support portals. The second method is notable because it turns a routine business process into a malware entry point, giving attackers access to systems that may sit outside an organisation's more closely monitored channels.

The operators seek control of infected machines and then move towards systems involved in code-signing and certificate management. The report describes a campaign aimed at stealing trust certificates or the means to activate them, allowing malicious software to appear as though it was signed by legitimate companies.

That tactic matters because signed software is more likely to pass through operating system safeguards. The group has focused on bypassing standard Windows protections, including SmartScreen, by using genuine code-signing certificates rather than fake or obviously compromised ones.

Expel pointed to data from Cert Graveyard showing 75 unique certificates linked to the group since 2024. It also highlighted an unusual shift in April 2025, when the attackers began using valid DigiCert certificates.

Expel reported the activity to DigiCert, which opened an investigation. According to Expel, the certificate authority confirmed that a support user's device had been infected through a malicious ticket submission.

That infection gave attackers access to initialisation codes for DigiCert customers, including those with open renewal orders, the research said. With those codes, the attackers could activate physical hardware tokens and sign malicious files in customers' names.

The findings add to concerns about attacks on the digital supply chain, particularly when trust mechanisms rather than software source code are targeted. By compromising the systems and processes used to issue or manage certificates, criminal groups can make malware appear legitimate without breaching a software vendor itself.

Aaron Walton, Senior Threat Intelligence Analyst at Expel, explained why the company had separated this cluster from the broader group. "We've chosen to give a new name to this actor group to demarcate our visibility into their activity," Walton said.

He added: "We've identified the actors as a separate part of a larger criminal group, which is often a distinction other organisations don't make."

Malware chain

Expel described Golden Gh0st RAT as the core tool used after the attackers establish a foothold. The malware family descends from a toolkit first seen in 2008, but the variants tracked here were described as heavily modified and tailored to current attack requirements.

"Golden Gh0st RAT is a robust and interactive backdoor designed to give attackers full operational control over the infected computer," Walton said.

Expel used its DeceptionPro tools to observe the malware in a structured way after identifying the certificate abuse. That work led to a decryption tool for the malware's network traffic, giving analysts a clearer view of communications between infected machines and command-and-control servers.

Expel also worked with Proofpoint to create Suricata detection rules for the malware's custom network traffic. Those rules have been added to Proofpoint's ET Pro and ET Open rule sets, extending detection options beyond Expel's own customers.

Defensive steps

The report urges organisations to tighten controls around customer support systems, which it identified as a primary route for initial access. Suggested measures include sandboxing files and restricting links submitted through ticketing queues so malicious content cannot reach support staff devices unchecked.

It also recommends auditing outbound traffic to content delivery networks from unusual applications, maintaining application allow lists tied to approved code-signing certificates, and using network detections to identify uncommon ports and protocols. Together, those steps are intended to make it harder for malware to fetch second-stage payloads and communicate with remote operators.

The broader message is that trust infrastructure has become a target in its own right. Rather than relying only on social engineering or software exploits, groups such as CylindricalCanine are also trying to exploit the business systems and security procedures that underpin software identity and user confidence.

Expel said the case showed how a malicious file submitted through a support workflow could lead to the theft of certificate-related data and, ultimately, to malware signed in the name of legitimate customers.