The recent DigiCert breach, attributed to the threat activity cluster CylindricalCanine, has raised concerns about the evolving tactics of Chinese cybercrime groups. This incident highlights the sophisticated methods employed by these actors, including the use of modified Gh0st RAT (Golden Gh0st RAT) and multi-stage loaders (RONINGLOADER) to distribute malware. The attack chain, involving phishing emails and DLL side-loading, showcases the complexity of modern cyber threats.
CylindricalCanine's primary tactic involves distributing files disguised as screenshots in phishing emails, leading to the download of additional payloads. The end goal is to trigger a DLL side-loading chain, using a legitimate executable to run a rogue DLL while displaying a decoy PDF document. This technique is then followed by the deployment of Golden Gh0st RAT, a modular malware with a wide range of capabilities, including data collection, persistence, and system control.
The DigiCert compromise involved the abuse of code-signing certificates, with the threat actor gaining unauthorized access to DigiCert and intercepting certificates intended for DigiCert customers. The actor used initialization codes and approved orders to obtain EV Code Signing certificates, which were then weaponized to sign Zhong Stealer malware artifacts. This incident underscores the importance of robust security measures and the need for organizations to continually update their defenses against evolving cyber threats.
The involvement of Chinese cybercrime groups, such as GoldenEyeDog and Silver Fox, further emphasizes the global nature of cybercrime. These groups are known for their targeting of various sectors, including gambling, gaming, and finance, using counterfeit websites and malware-laced software. The use of code-signing certificates in cyber operations has been observed in other threat actors, such as Black Basta, TamperedChef, and Rhysida, indicating a growing trend in the abuse of these certificates.
The DigiCert breach serves as a stark reminder of the importance of cybersecurity and the need for organizations to remain vigilant against evolving threats. As cybercriminals continue to adapt their tactics, it is crucial for security researchers and organizations to collaborate and share information to stay ahead of these threats. The incident also highlights the need for continuous monitoring and updating of security measures to protect sensitive data and systems from unauthorized access and malware attacks.
