Google has disclosed that attackers took control of three country-code top-level domains and used that access to mint fraudulent HTTPS certificates for several of its own domains and those of other organizations.
The affected namespaces were .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa. During the hijacks, the intruders rewrote authoritative DNS records and then obtained unauthorized certificates covering Google properties and other victims, according to Google’s advisory.
The technique is unusually dangerous because it defeats the trust signals users are taught to check. The attacker who controls DNS routing also holds the private key behind the forged certificate, so a victim visiting a correct-looking URL can be quietly handed a criminal copy of the site. There is no browser warning, because on paper the certificate is valid.
Google said its own systems were not compromised, and that the certificate authorities that issued the certificates were not at fault given how the attack unfolded. Chrome moved quickly to block the counterfeit certificates, which protects browser users, but Google cautioned that browser-side intervention should not be the only defense.
Domain owners are urged to watch Certificate Transparency logs, especially for the three affected suffixes, and to publish restrictive CAA records once control of DNS is restored. The company also warned that it cannot guarantee its analysis caught every compromised domain.
