Compromised ccTLD Registries Allowed Unauthorized Google Certificate Issuance

Attackers successfully hijacked three country-code top-level domains (ccTLDs) to obtain unauthorized HTTPS certificates for multiple Google domains, according to a statement from Google on October 6. The compromise involved the registries for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). While the attackers managed to secure these fraudulent certificates, Google emphasized that its own infrastructure and systems were not breached.

How it unfolded

• Attackers compromised third-party operators responsible for managing the .gh, .sl, and .as registries, according to BleepingComputer.
• The threat actors modified authoritative DNS records within these compromised registries.
• Using the manipulated DNS records, attackers obtained unauthorized HTTPS certificates for several Google domains, as reported by The Hacker News.
• Google publicly disclosed the incident on October 6, confirming the scope of the certificate theft.

Who is affected

The primary risk extended to any domain utilizing the .gh, .sl, or .as extensions. Because the attackers controlled the registries, they could potentially issue certificates for any domain within these zones, not just those belonging to Google. Possession of a valid HTTPS certificate allows an attacker to impersonate a legitimate site over an encrypted connection, facilitating man-in-the-middle attacks. According to The Hacker News, this capability put users of these specific country-code domains at risk of interception or spoofing. Google’s own services were not directly compromised, but the integrity of the certificate issuance process for these TLDs was violated.

The fix

The source material does not confirm that a specific patch, technical fix, or update has been released to remediate the underlying vulnerability in the registry operators. No details were provided regarding whether the compromised DNS records have been reverted or if the fraudulent certificates have been revoked. Managed service providers should monitor for further updates from the respective registry operators and Google regarding mitigation steps.

What to do and how to stay safe: Google

• Application-layer attacks consume server resources without saturating network links, bypassing simple bandwidth limits.
• Reflection attacks amplify traffic volume, making the source appear legitimate while hiding the true attacker behind open resolvers.
• Mitigation requires distinguishing legitimate user traffic from malicious requests using behavioral analysis, not just volume thresholds.

DDoS attacks exploit resource exhaustion and require layered defense strategies for effective mitigation. Implement automated traffic rerouting and redundancy to maintain service availability during active attacks.

Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers breach Google's internal servers?

No, Google stated that its own systems were not breached; only the external ccTLD registries were compromised.

Which specific country-code domains were hijacked?

The .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) registries were compromised.

What can attackers do with the stolen certificates?

Attackers can pose as the real site over an encrypted connection, potentially tricking users into trusting a malicious endpoint.