Attackers hijack ccTLD registries, obtain Google domain certificates

· Cybersecurity · Ghana · Sierra Leone

Attackers compromised the operators of three country-code top-level domains — Ghana (.gh), Sierra Leone (.sl) and American Samoa (.as) — and changed authoritative DNS records, Google disclosed on October 6. The intruders also obtained unauthorized HTTPS certificates for several Google domains. Google said its own systems were not breached, but every domain ending in those suffixes was put at risk, because the certificates could be used to impersonate legitimate sites and intercept traffic. The incident puts renewed attention on the third-party registries and registrars that underpin the DNS, where a single compromised operator can undermine trust for an entire national namespace. Affected registries and certificate authorities now face pressure to audit how domain-control validation is performed.

Why it matters：It shows how the DNS supply chain — registries and certificate authorities — remains a single point of failure that can undermine trust for entire national domains, pushing the industry toward tighter domain-validation controls.

Key points

  • Google said its own systems were not breached; the risk applies to any domain ending in .gh, .sl or .as.
  • Attackers modified authoritative DNS records after compromising third-party registry operators.
  • Unauthorized HTTPS certificates for Google domains could enable impersonation and traffic interception.

Sources (original reporting)

More stories from this day