Google Discloses Domains Affected by Sophisticated Third-Party Country-Code TLD Hijacks

Google has formally disclosed that several of its prominent domains were directly impacted by a sophisticated recent hijacking incident targeting third-party country-code top-level domains, commonly known as ccTLDs. The malicious campaign exposed numerous web properties to significant security risks by manipulating the foundational infrastructure that directs internet traffic.

The cyber security incident, which took place last week, specifically targeted the country-code top-level domains for Ghana, Sierra Leone, and American Samoa, corresponding to the .gh, .sl, and .as extensions respectively. By compromising these registries, malicious actors successfully put all individual websites and digital assets operating under those specific suffixes at severe risk of interception and impersonation.

Detailing the mechanics of the breach, the internet giant explained that during the course of these targeted hijacks, attackers systematically modified authoritative Domain Name System records. Furthermore, the perpetrators successfully obtained unauthorized HTTPS certificates covering several official Google domains, alongside various domains belonging to other external organizations and global enterprises.

Despite the issuance of these fraudulent cryptographic credentials, Google clarified that the Certification Authorities responsible for generating the certificates are entirely blameless, given the sophisticated and deceptive nature of the underlying attacks. Because the threat actors had successfully manipulated the authoritative DNS records, the CAs were technically deceived into believing the entities requesting the certificates legitimately controlled the targeted domains.

Immediately after learning of the security incident, Google moved swiftly to mitigate potential harm. The company blocked the unauthorized certificates associated with its own domains directly within the Chrome browser and actively coordinated with the issuing Certification Authorities to ensure their rapid revocation.

A thorough analysis of Certificate Transparency log data subsequently revealed that multiple other organizations, ranging from major global brands to popular online services, had similarly been affected by the ccTLD compromise. To ensure that everyday users navigating to those compromised sites were kept safe as quickly as possible, Google engineers proactively blocked these unauthorized certificates within the Chrome ecosystem. Where contact information was readily available, the company also reached out directly to impacted organizations to alert them to its findings and share details of the defensive actions taken.

While these proactive measures significantly reduced the window of exposure, the internet giant noted that certain domains might still be affected or remain vulnerable if proper remediation steps are not urgently undertaken by respective administrators. Consequently, Google is strongly encouraging all domain owners to actively monitor Certificate Transparency logs for any anomalous activity across all their domains, particularly those utilizing the .gh, .sl, or .as extensions. Furthermore, domain administrators are urged to publish restrictive Certification Authority Authorization DNS records to ensure robust administrative safeguards are firmly established once full DNS control has been successfully restored.

Explaining the technical rationale behind this recommendation, Google noted that Certification Authorities are frequently permitted to cache and reuse completed domain control validation checks for subsequent certificate issuance. Restoring a restrictive CAA policy, especially one that explicitly limits issuance to specific authorized accounts and validation methods, effectively prevents an attacker from weaponizing a cached validation state to mint brand-new certificates after a domain hijack has officially ended.