Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

This is a significant supply chain attack targeting the DNS trust model. Three country-code TLDs (ccTLDs) were compromised, allowing attackers to obtain valid HTTPS certificates for Google-owned domains. Google’s internal infrastructure was not breached, but the integrity of the certificate issuance process for these TLDs was.

Technical Breakdown – Attack Vector: Compromise of the registry operators for .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). – Impact: Attackers could request and receive valid TLS certificates from public Certificate Authorities (CAs) for any domain under these TLDs, including Google-owned domains. – TTPs (MITRE): – T1584.001: Compromise Infrastructure (Domains) – Sub-technique: Domain Registration Abuse. – T1588.002: Obtain Capabilities (Certificates). – T1557.001: Adversary-in-the-Middle (AiTM) – Sub-technique: LLMNR/NBT-NS Poisoning and SMB Relay (relevant for intercepting traffic if combined with DNS hijacking). – Affected Parties: Any entity with a domain under .gh, .sl, or .as was potentially exposed, not just Google. The specific Google domains targeted have not been disclosed, but the risk is that an attacker could intercept encrypted traffic to those domains.

Defense – Certificate Transparency (CT) Monitoring: Organizations should monitor CT logs for unexpected certificate issuance for their domains. This is the primary detection mechanism for this type of attack. – CAA Records: Ensure DNS Certification Authority Authorization (CAA) records are properly configured to restrict which CAs can issue certificates for your domains. This does not prevent a compromised registry from issuing a request, but it adds a policy layer. – Revocation: Google and the affected TLD operators will need to revoke the fraudulently obtained certificates and investigate the registry compromise.

Source: https://thehackernews.com/2026/10/attackers-hijack-gh-sl-and-as.html