This is a fascinating and nasty piece of infrastructure abuse. Attackers didn't just phish for credentials; they went after the root of trust itself.
The Attack Vector: Threat actors compromised the registry-level infrastructure for three country-code top-level domains (ccTLDs). By gaining administrative access to the namespace, they were able to issue fraudulent TLS certificates for high-value targets like Google, effectively bypassing standard CA validation checks for those specific TLDs. This is a step beyond typical domain squatting or subdomain takeover.
Technical Breakdown: – TTPs (MITRE): This maps to T1584.001 (Compromise Infrastructure: Domains) and T1553.002 (Subvert Trust Controls: Code Signing) . The core tactic is compromising the DNS trust chain at the registry level, not the individual domain registrar. – IOCs: The specific ccTLDs compromised are not named in the summary (likely due to ongoing remediation), but the IOCs to hunt for are: – TLS certificates issued for your organization's domains that chain to an unexpected or non-standard CA for that specific ccTLD. – DNS records (NS, SOA) for your domains that show an unauthorized delegation or modification at the registry level. – Affected Services: Any service relying on TLS trust for domains under the compromised ccTLDs. This includes email (SMTP), web traffic (HTTPS), and VPNs.
Defense: This is hard to detect from the endpoint. The primary mitigation is Certificate Transparency (CT) log monitoring. You must have automated alerting for any new certificate issued for your primary domains, especially those from unfamiliar CAs or for country-code domains you don't actively manage. Also, ensure your internal CA pinning and certificate revocation checks are aggressive.
Source: r/SecOpsDaily · by /u/falconupkid