Attackers hijack .gh, .sl, and .as registries to steal Google certificates

Google announced on October 6 that attackers had compromised three country-code top-level domain (ccTLD) registries to obtain unauthorized HTTPS certificates for various Google domains. The incident involved the hijacking of domains within the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) registries.

According to reports from The Hacker News and BleepingComputer, the attackers achieved this by compromising third-party operators responsible for managing these registries. By gaining control of these operators, the threat actors were able to modify authoritative DNS records. This manipulation allowed them to request and receive valid HTTPS certificates for Google domains, despite having no legitimate authorization to do so.

Technical Context and Impact

The core of this attack relied on the subversion of the domain registration infrastructure rather than a direct breach of Google's internal networks. Google explicitly stated that its own systems were not breached in this incident. Instead, the vulnerability existed in the third-party management of the specific ccTLDs.

By modifying the authoritative DNS records for these top-level domains, attackers could redirect domain resolution or prove control over the domains to certificate authorities. Once they obtained the unauthorized HTTPS certificates, the attackers possessed the cryptographic keys necessary to encrypt traffic. As noted by The Hacker News, possessing such a certificate allows an attacker to pose as the real site over an encrypted connection. This capability is critical for man-in-the-middle attacks, where an adversary can intercept, read, and alter communication between users and the legitimate service without triggering standard security warnings in browsers.

Affected Domains and Registries

The attack specifically targeted three distinct country-code top-level domains: .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa. While the immediate goal was to obtain certificates for Google domains, the compromise of these registries placed any domain ending in these extensions at risk.

The scope of the risk extends beyond Google. Because the attackers controlled the authoritative DNS records for these entire top-level domains, they theoretically held the power to affect any domain registered under .gh, .sl, or .as. The compromise of third-party operators suggests that the security perimeter for these registries was breached externally, allowing the attackers to inject malicious changes into the root of trust for these specific domain extensions.

What should you do?

Security professionals should monitor for any unusual certificate issuance or DNS changes associated with domains under the .gh, .sl, and .as extensions. Organizations relying on services hosted on these domains should verify the integrity of their DNS configurations and certificate chains.

At this time, no specific patch or fix has been confirmed by the registry operators or Google to address the underlying compromise of the third-party operators. Users and administrators should remain vigilant for potential man-in-the-middle attacks, particularly when accessing services associated with these ccTLDs. There is no indication that Google's core infrastructure requires immediate action from end-users, but the trust model for these specific domain extensions has been temporarily undermined.

What to do and how to stay safe: Google

• Urgency and secrecy are the primary psychological triggers used to bypass rational decision-making processes.
• Technical indicators like spoofed addresses are often invisible without specific tooling, so behavioral context matters more.
• Verification must occur through a pre-established out-of-band channel, not the one currently in use.

Trust but verify is the only reliable defense against social engineering. Always confirm urgent requests through a separate, pre-established communication channel.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did attackers breach Google's internal systems?

No, Google stated that its own systems were not breached; the attackers compromised third-party operators of the ccTLD registries.

Which country-code top-level domains were compromised?

The .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) registries were compromised.

What did the attackers do with the compromised registries?

They modified authoritative DNS records to obtain unauthorized HTTPS certificates for Google domains.