Attackers Hijack Country‑Code Domains to Obtain Fraudulent HTTPS Certificates for Google and Other Services
What Happened — Attackers compromised the DNS infrastructure behind three country‑code top‑level domains (.gh, .sl, .as). By controlling the DNS records they passed domain‑validation checks and obtained legitimate‑looking HTTPS certificates for Google‑owned and other high‑profile domains. The forged certificates enable convincing impersonation of trusted services.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of external DNS and certificate‑issuance processes is a core control‑assurance activity that can surface such hijacks before they are abused.
- Demonstrating due‑diligence over third‑party registrars and certificate authorities provides defensible evidence for audits and reduces supply‑chain risk.
- Mapping this incident to the “external service and vendor oversight” control objective satisfies multiple frameworks (e.g., NIST CSF, ISO 27001) with a single control.
Who Is Affected — Technology‑focused organizations, SaaS providers, and any entity that relies on domains ending in .gh, .sl, or .as for user‑facing services.
Recommended Actions
- Integrate DNS change‑feed and Certificate Transparency log monitoring into your continuous control‑assurance platform.
- Validate that your DNS registrar and CA have robust incident‑response processes; document oversight activities as audit evidence.
- Conduct a rapid review of all services that use the affected ccTLDs and re‑issue certificates where necessary. Source: Malwarebytes Labs
Technical Notes
- Attack vector: hijacked DNS records (third‑party dependency) used to satisfy CA domain‑validation checks.
- No vulnerability CVE; the issue stems from insufficient verification of DNS ownership by CAs.
- Impact: potential credential theft, payment fraud, and brand impersonation. Source: Malwarebytes Labs