Google Discloses Third-Party ccTLD Hijack Affecting Several Company Domains and Global Brands

Google has formally disclosed that several of its domains were compromised during a sophisticated and targeted cyberattack last week involving the hijack of third-party country-code top-level domains, commonly known as ccTLDs. The malicious campaign specifically targeted the registries for .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa), exposing all digital properties operating under those national suffixes to severe security risks, including interception, data exposure, and impersonation.

The incident highlights ongoing vulnerabilities within the global domain name system supply chain, particularly at the registry level where authoritative control can be manipulated. According to technical details shared by the internet giant, the threat actors executed the campaign by forcibly modifying authoritative Domain Name System (DNS) records associated with the targeted ccTLDs. By seizing control of these foundational routing directories, the attackers were able to successfully redirect traffic and secure unauthorized HTTPS cryptographic certificates covering several official Google domains, as well as a multitude of other high-profile digital assets belonging to unrelated corporate entities, global brands, and popular online services.

Despite the issuance of these fraudulent digital credentials, Google has clarified that the Certification Authorities—the trusted third-party organizations responsible for validating and signing digital certificates—bear no responsibility for the breach. Given the complex nature of the attacks, which leveraged compromised registry-level DNS controls to successfully impersonate legitimate domain owners during automated validation checks, the CAs operated under the assumption that the requests were legitimate.

The compromise was brought to light through diligent threat monitoring and analysis. Immediately after discovering the security incident, Google moved swiftly to mitigate the threat landscape for its own infrastructure. The company proactively blocked the unauthorized and fraudulent certificates for its affected domains within the Google Chrome browser ecosystem. Simultaneously, Google coordinated closely with the issuing Certification Authorities to ensure that the rogue certificates were globally revoked, rendering them useless for future interception attempts.

However, the scope of the incident extended far beyond Google’s internal infrastructure. A deep analysis of public Certificate Transparency log data—a vital public framework designed to monitor the issuance of SSL/TLS certificates—revealed that multiple other global organizations, prominent international brands, and widely used online services had also been ensnared in the widespread campaign. Because the attackers managed to subvert the DNS records of entire top-level domains, any organization utilizing those extensions was potentially exposed to certificate mis-issuance without their immediate knowledge or consent.

Recognizing the broader systemic risk posed to the wider internet community, Google expanded its protective and notification efforts. To ensure users of those third-party sites were kept safe from potential man-in-the-middle attacks as quickly as possible, the company proactively blocked the unauthorized certificates directly within Chrome. Furthermore, wherever possible, Google’s security teams reached out directly to impacted organizations to alert them to the findings, share forensic insights, and detail the protective actions that had been taken on their behalf.

Even with these rapid mitigation measures and widespread revocations, the technology titan has cautioned that the digital fallout may still be lingering. Google noted that despite its extensive steps to identify, isolate, and block the unauthorized certificates across the browser ecosystem, certain domains and digital services might still remain affected or vulnerable if administrative controls have not been fully resecured and verified.

In light of these persistent risks, Google is strongly encouraging all domain owners—particularly those operating infrastructure under the .gh, .sl, and .as country-code top-level domains—to remain highly vigilant. Administrators are advised to continuously monitor Certificate Transparency logs for any anomalous or unexpected certificate issuances related to their corporate domains. Furthermore, Google recommends that system administrators publish restrictive Certification Authority Authorization DNS records as a crucial layer of defense to ensure robust safeguards are firmly in place once full administrative DNS control has been completely restored.

Explaining the technical rationale behind this recommendation, Google noted that Certification Authorities are frequently permitted under industry standards to cache and reuse completed domain control validation checks for subsequent certificate issuance requests. Because of this caching mechanism, simply cleaning up a DNS record or recovering from a temporary hijack may not be enough to stop a determined adversary. Restoring a restrictive CAA policy—especially one explicitly tailored to restrict issuance to specific, pre-approved accounts and strict validation methods—actively prevents an attacker from leveraging a previously cached validation state to mint new, unauthorized certificates after a ccTLD hijack has officially ended.