Full Report
Trusted brand impersonation without the usual browser certificate warnings spells trouble
Analysis Summary
# Incident Report: Multi-ccTLD DNS Hijacking and Unauthorized Certificate Issuance
## Executive Summary
In late September 2026, attackers successfully hijacked several country-code top-level domain (ccTLD) registries, including .gh, .sl, and .as. This allowed the threat actors to alter authoritative DNS records and obtain valid, unauthorized HTTPS certificates for Google and other high-profile organizations. The incident enabled "perfect" brand impersonation without triggering browser warnings, though Google mitigated the risk for Chrome users via automated certificate blocking.
## Incident Details
- **Discovery Date:** Week of September 28, 2026
- **Incident Date:** Late September 2026
- **Affected Organizations:** Google and multiple undisclosed organizations
- **Sector:** Technology / Multi-sector
- **Geography:** Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as)
## Timeline of Events
### Initial Access
- **Date/Time:** Late September 2026
- **Vector:** Hijacking of authoritative ccTLD registry infrastructure.
- **Details:** Attackers gained control over the management systems of the .gh, .sl, and .as namespaces, allowing them to modify authoritative DNS records for targeted domains.
### Lateral Movement
- **Details:** Not applicable to Google's internal network; attackers moved "laterally" across the DNS hierarchy by targeting specific high-value domains within the compromised registries to redirect traffic.
### Data Exfiltration/Impact
- **Impact:** Attackers minted fraudulent HTTPS certificates. By controlling both DNS and the private keys for these certificates, they could intercept user data (MitM), modify site content, and distribute malware under the guise of legitimate, encrypted connections.
### Detection & Response
- **Detection:** Google detected the anomalies via internal monitoring and Certificate Transparency (CT) log analysis.
- **Response:** Google implemented browser-side blocks in Chrome to invalidate suspected counterfeit certificates across the affected ccTLDs.
## Attack Methodology
- **Initial Access:** Registry-level compromise (ccTLD infrastructure).
- **Persistence:** Control over authoritative DNS records allowed for sustained redirection.
- **Defense Evasion:** Use of legitimate Certification Authorities (CAs) to mint valid certificates, ensuring no "Not Secure" warnings appeared in user browsers.
- **Lateral Movement:** DNS Hijacking.
- **Collection:** Potential Interception of user credentials or sensitive data via Man-in-the-Middle (MitM).
- **Impact:** Brand impersonation and potential data interception.
## Impact Assessment
- **Financial:** Undisclosed; potential loss for organizations whose users were phished.
- **Data Breach:** Potential interception of transit data for users who visited the hijacked domains.
- **Operational:** Disruption of legitimate traffic routing for affected regional domains.
- **Reputational:** High risk of brand damage due to "trusted" impersonation.
## Indicators of Compromise
- **Network indicators:** Unexpected changes in authoritative NS (Name Server) records or A records for domains in the .gh, .sl, and .as zones.
- **File indicators:** N/A (Infrastructure level).
- **Behavioral indicators:** Unauthorized certificate issuance events appearing in Certificate Transparency (CT) logs for domains not requested by the legitimate owner.
## Response Actions
- **Containment:** Chrome browser intervention to block suspected unauthorized certificates.
- **Eradication:** Work with ccTLD registry operators to restore authoritative DNS control.
- **Recovery:** Revocation of fraudulent certificates and restoration of legitimate DNS records.
## Lessons Learned
- **Registry Vulnerability:** Organizations are at the mercy of the security posture of the ccTLD registries they use; regional domains may have weaker security than gTLDs (like .com).
- **CA Reliability:** CAs function as intended during DNS hijacks; if the DNS points to the attacker, the CA will validate the attacker's request as "legitimate."
- **Browser Limits:** Browser-side intervention is effective but not exhaustive, especially for non-Chrome users.
## Recommendations
- **Monitor CT Logs:** Implement near real-time monitoring of Certificate Transparency logs to detect unauthorized issuance immediately.
- **Implement CAA Records:** Use Certification Authority Authorization (CAA) records to restrict which CAs can issue certificates.
- **Enhanced CAA:** Use extensions (RFC 8657) to restrict issuance to specific accounts and validation methods to prevent attackers from using cached validation states.
- **Registry Locks:** Where available, employ "Registry Lock" services to prevent unauthorized DNS changes at the registrar/registry level.