Chinese Sub-Crew 'CylindricalCanine' Fingered for DigiCert Break-In

Key points

• Researchers at Expel have attributed the April 2026 break-in at DigiCert to a group they call CylindricalCanine.
• CylindricalCanine is a sub-crew of GoldenEyeDog, a Chinese cybercrime group also tracked as APT-Q-27, Dragon Breath and Miuuti Group.
• The parent group is best known for targeting gambling and gaming companies across Asia.
• DigiCert issues the digital certificates websites and software makers use to prove they are who they claim to be.
• The attribution links a mainstream trust provider to a criminal cluster previously focused on the casino underworld.

A Chinese cybercrime offshoot is now being blamed for one of the most awkward security incidents of the year.

Researchers at the security firm Expel say the April 2026 intrusion at DigiCert, one of the world's largest issuers of digital certificates, was the work of a group they've named CylindricalCanine. Digital certificates are the cryptographic files that let your browser confirm a website is genuine and let software you install prove it came from the company it says it did. The finding was first reported by The Hacker News.

Who is CylindricalCanine?

Expel describes CylindricalCanine as a sub-group of a larger Chinese cybercrime crew called GoldenEyeDog, which other security firms track as APT-Q-27, Dragon Breath or Miuuti Group. Different labels, same people.

GoldenEyeDog isn't a household name in the West. Its usual hunting ground is the gambling and gaming sector across Southeast Asia, where it has spent years slipping malicious software onto the machines of casino operators and the smaller firms that supply them.

That history makes the DigiCert attribution unusual. A crew that normally chases casino back offices is now accused of breaking into a company whose products underpin trust across the wider internet.

Why does a certificate company matter to ordinary people?

Certificates are the plumbing of online trust. Your bank's padlock means something because of one. Windows often lets a program install without warning because that program carries a valid code-signing certificate, a stamp confirming the file really is from the company on the label.

If criminals get inside a certificate issuer, the concern is straightforward: they could obtain those stamps of approval for malicious software, making malware look like legitimate updates from trusted brands. Our 8 July story on how GitHub's Verified badge can be faked without the signing key shows this class of trust-abuse isn't theoretical.

DigiCert hasn't publicly confirmed the full scope of what CylindricalCanine accessed. Expel's writeup focuses on the technical fingerprints tying the intrusion to the group rather than the volume of data taken.

Should you worry?

For most readers, there's nothing to click and nothing to patch. Your bank, your employer and the makers of your apps might hold DigiCert certificates; you personally don't.

Keep your operating system and browser set to update automatically: that's how revoked or abused certificates get pulled from circulation. Be wary of software update prompts arriving by email or pop-up rather than from inside the application itself. If you work in IT at a company relying on DigiCert for code-signing or website certificates, check your vendor advisories now.

What happens next

Expel's attribution will need testing by other researchers before it hardens into consensus. Chinese groups are notoriously fluid, with operators moving between clusters and sharing tools, and GoldenEyeDog's gambling-focused history doesn't obviously explain what its people wanted from a certificate authority.

One working theory is blunt. Code-signing certificates fetch real money on criminal markets, and a group skilled enough to breach casinos has the skills to monetise what it stole.

The more uncomfortable theory is that someone paid them to try. That question is the one worth watching.