Loading story…
DigiCert disclosed a breach in which a threat actor socially engineered its support team with a malicious ZIP file disguised as a customer screenshot, compromising two analyst workstations and gaining access to initialization codes for previously approved but undelivered EV code-signing certificate orders. The attacker used that access to obtain legitimate trusted code-signing certificates, and DigiCert revoked 60 certificates in response, including 27 directly linked to the intrusion. Reporting indicates 11 of those certificates were already used in the wild to sign Zhong Stealer malware, while a misconfigured CrowdStrike EDR agent on one compromised machine helped the attacker remain undetected for nearly two weeks.
The incident unfolded alongside a separate trust-related disruption affecting DigiCert certificates on Windows systems: a faulty Microsoft Defender signature update released around April 30 falsely detected the legitimate DigiCert Assured ID Root CA and DigiCert Trusted Root G4 certificates as Trojan:Win32/Cerdigent.A!dha. On affected hosts, Defender quarantined registry entries from the Windows trust store, raising the risk of SSL/TLS validation failures, broken code-signing verification, browser warnings, and enterprise application outages. Microsoft acknowledged the false positives and issued corrected definitions, with version .430 cited as restoring the removed certificates automatically, while DigiCert tightened controls by enforcing MFA on administrative workflows, restricting access to initialization codes, limiting attachment types in support channels, and improving logging.
Pull IOCs and campaign context straight into your stack.
12 events from the most recent confirmed update back to the earliest known activity.
Researchers said the April 2026 DigiCert intrusion was carried out by a threat cluster they track as CylindricalCanine, which Expel assesses is a subgroup of the Chinese cybercrime group GoldenEyeDog. This extends prior reporting by attributing the DigiCert support-environment breach itself, not just the Zhong Stealer malware signed with abused certificates.
Expel released a technical report on CylindricalCanine describing Golden Gh0st Loader and Golden Gh0st RAT, including decrypted protocol behavior, tooling to recover victim telemetry, and the malware’s broader capabilities. The report also published infrastructure, hashes, protocol details, and Suricata detections to help defenders identify the activity.
Researchers associated the Zhong Stealer malware signed with abused DigiCert-issued certificates with the threat group GoldenEyeDog (APT-Q-27). DigiCert did not confirm that this group was responsible for the breach of its support environment itself.
In response to the April intrusion, DigiCert enforced MFA on administrative workflows, restricted access to initialization codes during proxied customer sessions, limited attachment file types in support channels, and improved logging. These measures were introduced to reduce the risk of similar certificate issuance abuse.
Microsoft acknowledged the Defender detection problem and released corrective security intelligence updates. Definition version .430 was cited as a key fix that began automatically restoring the quarantined DigiCert certificates on affected systems.
Security researcher Florian Roth publicly drew attention to the Microsoft Defender false-positive issue and shared ways for administrators to verify whether the affected DigiCert root certificates had been restored. His reporting helped clarify the operational impact on Windows trust stores.
Around April 30, 2026, a Microsoft Defender antimalware signature update began falsely detecting the legitimate DigiCert Assured ID Root CA and DigiCert Trusted Root G4 certificates as Trojan:Win32/Cerdigent.A!dha. On affected Windows systems, Defender quarantined related registry entries from the Windows trust store, risking SSL/TLS validation and code-signing failures.
As part of its response to the support-system intrusion, DigiCert cancelled pending EV code-signing certificate orders associated with the exposed initialization-code workflow. The step was taken to cut off any further certificate issuance opportunities tied to the compromised support access.
Following its investigation, DigiCert revoked 60 code-signing certificates, including 27 linked directly to the attacker. The revocations were intended to contain abuse of trusted certificates obtained during the intrusion.
One compromised DigiCert machine had a misconfigured CrowdStrike EDR agent, which allowed the attacker to remain undetected for nearly two weeks. This prolonged the impact of the intrusion and delayed response.
After compromising DigiCert support systems, the attacker obtained legitimate EV code-signing certificates tied to previously approved orders. DigiCert later determined that 27 revoked certificates were directly associated with the attacker, and 11 had already been used to sign Zhong Stealer malware in the wild.
In early April 2026, a threat actor socially engineered DigiCert support staff by sending a ZIP file disguised as a customer screenshot through a chat channel. Two support analyst machines were compromised, giving the attacker access to initialization codes for previously approved but undelivered EV code-signing certificate orders.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourceexpel.com
Open sourcecybersecuritynews.com
Open sourcedarkwebinformer.com
Open sourcecybersecuritynews.com
Open sourceopennet.me
Open sourcebugzilla.mozilla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A faulty Microsoft Defender signature update released on April 30 incorrectly detected legitimate DigiCert root certificates as `Trojan:Win32/Cerdigent.A!dha`, triggering alerts across Windows environments and, in some cases, quarantining or removing trusted roots from stores such as **AuthRoot**. The flagged thumbprints were tied to valid DigiCert trust anchors, including **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4**, causing administrators and SOC teams to suspect compromise and disrupting certificate trust relationships used for TLS validation and code signing. Microsoft later acknowledged the detections were erroneous and remediated the issue with updated Defender security intelligence, including version `1.449.430.0` or later. Reporting indicates the overly broad detection logic may have stemmed from Microsoft’s response to a separate DigiCert code-signing certificate incident linked to abuse such as the **Zhong Stealer** campaign, but the certificates flagged in this case were legitimate and not revoked. The false positive prompted some organizations to take unnecessary recovery actions, including system rebuilds, underscoring the operational risk of automated detections that affect root certificate trust stores.
Jun 29, 2026
DigiNotar, a Dutch certificate authority, was compromised and used to issue at least 531 fraudulent SSL certificates for 344 domains, including `google.com`, enabling spoofing and man-in-the-middle attacks against supposedly secure services. Reporting indicated the fake Google certificate was likely used to intercept Gmail traffic from users in Iran, potentially exposing roughly 300,000 accounts and putting dissidents at risk. The breach was publicly linked to the actor who had claimed responsibility for the earlier Comodo certificate fraud, and it intensified criticism of the certificate authority trust model as incapable of resisting nation-state abuse. The fallout spread quickly across browsers, operating systems, and government services. Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates, while Microsoft issued advisory `2607712` and updates including `KB2607712` and `KB2616676` to place DigiNotar certificates in the Windows Untrusted Certificate Store; Safari users were reported to remain exposed for a time. In the Netherlands, the government took over DigiNotar’s operations after investigators found severe security failures, warned that it could not guarantee the safety of its own websites, and shifted trust for public-sector certificates as DigiNotar’s business collapsed into bankruptcy.
Jun 29, 2026
Google reported that it detected and blocked an attempted man-in-the-middle campaign after attackers used a fraudulent certificate for `google.com`, allowing interception of users' connections to Google services. The certificate was traced to Dutch certificate authority DigiNotar, whose systems had been compromised, and the attack reportedly affected hundreds of thousands of users, primarily in Iran. Google said Chrome's built-in certificate checks helped expose the issue after a user encountered Gmail certificate warnings. Subsequent reporting found that attackers exploited unpatched DigiNotar systems and generated at least **531 rogue certificates**, turning the breach into a major failure of the internet's certificate trust model. The Dutch government assumed control of DigiNotar, browser vendors revoked trust in its certificates, and the company ultimately collapsed. The incident became a catalyst for stronger certificate authority controls and broader adoption of defenses including **certificate pinning** and **Certificate Transparency**.
Aug 4, 2026