Hackers Hijack Google and Global Domains via Compromised ccTLD Registries
What Happened – Attackers breached the operators of the .GH, .SL and .AS country‑code top‑level domains, altered authoritative DNS records, and used the forged records to obtain valid HTTPS certificates for Google‑owned domains and for a range of other brands. Google blocked the rogue certificates in Chrome via CRLSets and worked with the issuing CAs to revoke them, but warned that not all affected domains may have been identified.
Why It Matters for Trust & Control Assurance
- This incident exemplifies a supply‑chain breach where a third‑party DNS registry was the weak link; continuous vendor‑risk monitoring is designed to surface such compromises early.
- The ability to detect unauthorized certificate issuance through Certificate Transparency logs demonstrates the value of real‑time control evidence for audit readiness.
- Demonstrating documented oversight of external registrars satisfies a core control objective that maps to many frameworks (e.g., NIST CSF 2.0 “Supply Chain Risk Management”).
Who Is Affected – Technology SaaS providers (including Google), any organization that owns domains under the compromised ccTLDs, and downstream customers who rely on those domains for brand trust.
Recommended Actions
- Verify the integrity of DNS records for all owned domains, especially those in third‑party registries.
- Enroll in continuous Certificate Transparency monitoring and integrate alerts into your security operations workflow.
- Review and tighten third‑party oversight contracts with domain registrars, ensuring they meet documented change‑control and audit‑evidence requirements.
Technical Notes – Attack vector: compromise of third‑party DNS registry operators (supply‑chain breach). The threat actors modified TXT records used for domain validation, enabling fraudulent TLS certificate issuance. Google mitigated via Chrome’s CRLSets and coordinated revocation with the CAs. Source: BleepingComputer