Attackers hijack .gh, .sl and .as ccTLD DNS records to obtain unauthorized TLS certificates for Google and other major services

Attackers took control of the DNS records for selected domains under three country-code top-level domains (.gh, .sl and .as). That let them pass the automated domain checks that certificate authorities run, and they obtained TLS certificates they were not entitled to, including for several Google domains and other major brands. Google says it has updated Chrome to block every certificate it identified and has worked with the issuing authorities to revoke those for Google properties. The number of certificates, the affected brands beyond Google, the dates and the exact method of the DNS takeover are not given in the material we have.

A fraudulent certificate lets an attacker impersonate a site to anyone whose browser trusts it, so the risk is mainly to people on a network the attacker controls or can redirect, not to everyone. The incident shows that automated certificate issuance is only as strong as the DNS it relies on, and that a weak registry can undermine well-run companies. Security teams can act now by checking certificate transparency logs for their own domains, setting CAA records that limit who may issue certificates, and reviewing which of their domains sit under small or lightly protected registries. Whether this is a one-off or a pattern depends on how the three registries were compromised, which is not yet clear.

The coverage reaches us second-hand via Ars Technica, with no link to Google's own post, so the scope is unverified. Phrases about attackers being able to "cryptographically impersonate" infrastructure describe what a bad certificate can do in theory, not evidence of any confirmed interception or user harm. The headline's "large services" is vague, as only Google is clearly named.

1. 01Publication of Google's original disclosure or a registry statement from the .gh, .sl and .as operators, giving the number of certificates, the dates and how the DNS records were altered.
2. 02Certificate transparency log analysis by independent researchers showing how many certificates were issued, which brands were hit, and which certificate authorities issued them.
3. 03Any evidence of actual misuse such as traffic interception, plus follow-up action from certificate authorities or browser vendors, for example tighter validation rules, mandatory multi-perspective DNS checks or extra scrutiny of ccTLD-based validation.