Malwarebytes Labs: Attackers Hijacked Country-Code Domains to Impersonate Google

Cybercriminals successfully compromised three country-code top-level domains to obtain digital certificates that facilitate the impersonation of trusted online services, according to research published by Malwarebytes Labs. The attack group leveraged control over these namespaces to issue valid certificates for domains mimicking major technology platforms, including Google.

The attackers targeted the infrastructure responsible for managing country-code namespaces, allowing them to generate certificates that browsers would treat as legitimate. By hijacking these specific domains, the threat actors bypassed standard trust validation mechanisms. This technique enables the creation of phishing sites that appear secure and authentic to end users, significantly increasing the likelihood of credential theft.

Attack Methodology and Scope

Malwarebytes Labs identified that the compromise involved three distinct country-code namespaces. The researchers found that the attackers did not merely register similar-looking domains but actually took control of the domain management infrastructure itself. This level of access allowed them to request and receive SSL/TLS certificates for subdomains that matched legitimate service providers. The use of valid certificates makes the malicious sites indistinguishable from the real services in web browsers, as the padlock icon and security indicators remain intact.

The scope of the attack highlights a vulnerability in the chain of trust for domain name system management. When attackers gain administrative control over a country-code top-level domain, they can issue certificates for any domain under that namespace. This capability is particularly dangerous because it undermines the public key infrastructure that relies on domain validation. The research indicates that the attackers were specifically targeting high-value brands to maximize the impact of their phishing operations.

Impact on Trust and Security

This incident affects the integrity of certificate transparency logs and the reliability of domain validation processes. Security professionals must recognize that a valid certificate does not guarantee the legitimacy of the website behind it, especially when the issuing authority has been compromised. The attack demonstrates how infrastructure-level compromises can be leveraged to create highly convincing phishing campaigns. Users who rely solely on browser security indicators may be misled into entering sensitive information on malicious sites that possess valid, albeit fraudulently obtained, certificates.

The compromise of country-code namespaces represents a significant escalation in phishing tactics. Traditional defenses that check for certificate validity are insufficient against this type of attack. Organizations must monitor for unusual certificate issuance patterns and investigate any certificates issued by compromised namespaces. The research from Malwarebytes Labs serves as a warning that the domain name system infrastructure itself is a high-value target for cybercriminals seeking to impersonate trusted entities.

What should you do?

Security teams should monitor certificate transparency logs for unusual issuance patterns related to the compromised country-code domains. Organizations must verify the legitimacy of domains receiving sensitive data, regardless of certificate validity. Users should be educated to check the full domain name, not just the security indicator, before entering credentials. Incident response plans should include procedures for identifying and blocking traffic to domains using certificates from these compromised namespaces.

What to do and how to stay safe: Malwarebytes

• Monitor certificate transparency logs for new certificates issued by the three compromised country-code namespaces identified by Malwarebytes Labs.
• Verify the full domain name of any login page, ensuring it matches the expected service provider exactly, rather than relying solely on the browser's security padlock.
• Implement strict email and web filtering rules to block access to domains associated with the hijacked country-code top-level domains.
• Educate users on the limitations of SSL certificates, emphasizing that a valid certificate does not guarantee a website is legitimate if the domain infrastructure is compromised.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific country-code domains were compromised in this attack?

Malwarebytes Labs reported that three country-code namespaces were compromised, but the specific top-level domain extensions were not detailed in the provided summary.

Did the attackers steal user credentials from Google in this incident?

The source material states that attackers obtained certificates to impersonate Google and other services, but it does not confirm whether any user credentials were actually stolen.

Is there a patch or fix available for this domain hijacking vulnerability?

No fix has been confirmed yet in the provided source material, as the compromise involves external infrastructure rather than a software vulnerability in a specific product.