Attackers hijack three country code domains to obtain unauthorized Google certificates

Cybercriminals compromised the infrastructure behind three country-code top-level domain namespaces, Malwarebytes Labs and Infosecurity Magazine reported on October 8. According to Google, hackers targeted the .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa registries to obtain unauthorized HTTPS certificates for Google domains and other organizations. The Register and The Hacker News also reported that attackers manipulated the internet addressing infrastructure to pass verification checks. [1][2][4][5]

Malwarebytes Labs reported that the incident was not a break in encryption and that internal Google systems were not breached. Instead, attackers manipulated domain name system addressing to pass validation checks required for certificates they did not legitimately control. Because these country-code domain endings are not limited to sites serving those specific regions, security researchers warn that the risk extends to users globally. [1]

As FTMQ Security reported earlier, attackers compromised the .gh, .sl, and .as registries to generate 12 unauthorized HTTPS certificates for Google and YouTube domains. Google confirmed on October 6 that its systems remained secure, and Chrome blocked the unauthorized certificates to protect user connections. [8]