This is a significant supply chain attack targeting the DNS infrastructure itself. Threat actors compromised the backend systems of third-party ccTLD registry operators for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl). This allowed them to modify authoritative DNS records for several Google-owned domains, including at least one used for email security (likely related to Google Workspace).
Technical Breakdown: – TTPs: This is a classic Supply Chain Compromise (MITRE T1195) targeting DNS registries. The attackers modified DNS records (MITRE T1587.001) to redirect traffic and obtained unauthorized HTTPS certificates (MITRE T1588.001) from public CAs for the hijacked domains, enabling them to decrypt or intercept traffic. – Impact: The attackers could intercept email, redirect web traffic, or issue valid-looking certificates for Google properties. This bypasses typical perimeter defenses because the compromise is at the registry level, not the domain owner's account. – IOCs: Specific hijacked domains and the rogue IPs used in the DNS records are likely being tracked by Google and the affected registries. The article does not list specific hashes or IPs.
Defense: Organizations should monitor for unexpected changes to DNS records for critical domains, especially those managed through third-party registrars. Enabling DNSSEC validation on recursive resolvers can help detect unauthorized DNS modifications, though it does not prevent the registry-level change itself. This is a strong reminder to treat ccTLD registries as critical third-party vendors.
Source: r/SecOpsDaily · by /u/falconupkid