Hijacked .gh, .sl and .as registries gave attackers valid Google certificates

Attackers took control of the DNS behind three country-code domains: Ghana's .gh, Sierra Leone's .sl and American Samoa's .as. They used that control to get valid HTTPS certificates for Google names. Google disclosed the attacks on 6 October.

BleepingComputer reports that the attackers broke into the third-party operators of the three domains and changed authoritative DNS records, pointing names at servers they controlled. That was enough to pass the certificate authorities' automated checks. Those checks prove that someone controls a domain's DNS. They don't prove that person owns the business behind it, as Cybersecurity News points out. With a valid certificate, an attacker can pose as a brand and show visitors whatever they like.

Google says its own systems were not breached, The Hacker News reported. On this publication's reading, though, any domain ending in .gh, .sl or .as was put at risk.

The coverage disagrees on who was breached. GuruFocus, an automated stock-alert service, calls the targets "third-party registrars". BleepingComputer says third-party operators of the domains. These are different things: a registrar sells names to the public, while the operator runs the registry itself. Changing authoritative DNS for names across a whole country domain is an operator-level attack, which fits BleepingComputer's account.

Twelve certificates, and the count isn't finished

The Hacker News searched Certificate Transparency logs, the public records of issued certificates. It found at least 12 certificates covering seven Google and YouTube domains, including google.com.gh, google.sl and google.as. Let's Encrypt issued 11 and ZeroSSL issued one. They showed up one country at a time: .gh on 22 September, .sl on 25 September and .as on 27 September.

The two .gh certificates and the ZeroSSL one went on 26 September and the other nine on 1 October. Some stayed live for about a day and a half, and others for nearly a week. "Yes, certificates for Google and YouTube were issued, and have been revoked," Let's Encrypt's Matthew McPherrin wrote on the company's community forum.

That count covers Google's names only. Google said, as quoted by BleepingComputer, that log data "revealed additional organizations, including several leading global brands and widely used online services, believed to have been impacted by the same attacks." It hasn't named them, so nobody outside Google knows the full total.

Chrome blocked the bad certificates through CRLSets, its emergency blocklist. Chrome users are covered, while people on other browsers depend on the certificate authorities' own revocations, which Cert Spotter shows were all in place by 1 October. Google's Chrome Secure Web and Networking Team wrote that "we cannot guarantee that our analysis identified every affected domain," The Hacker News reported.

According to The Hacker News and Cybersecurity News, Google hasn't said who the attackers are, how they got in, or whether the three domains are now secure. Nor has it said whether any of the certificates was actually used to impersonate a Google site.

The New Zealand exposure

None of the coverage mentions New Zealand, so what follows is this publication's own analysis. A New Zealand business holding a brand, vanity or defensive name under a small country domain, such as .as, is exposed in the same way. The .as registry is run by an outside operator. A business can't audit that operator's security. It can lock its registrar account and use strong passwords, and still lose control of its name if someone breaks in further up the chain. Google runs its own certificate authority, and it still had seven names hijacked this way. Neither InternetNZ, which runs .nz, nor NCSC NZ is quoted in any of the coverage.

In practice, someone in your business now needs to watch every name you hold, not just the ones that make money.

Watch the certificate logs. Google advises owners to monitor Certificate Transparency logs across the whole portfolio, including parked domains, BleepingComputer reports. Cybersecurity News says regional websites should be included too. Anyone holding a .gh, .sl or .as name should check recent log entries now for certificates they didn't request.

Publish a strict CAA record. This is a DNS setting that names which certificate authority may issue for your domain. Google recommends limiting it to your own account with that authority, and to specific validation methods, where the authority supports this. But according to The Hacker News, the CAA standard says the record can't stop issuance during an active hijack, because an attacker who controls your DNS can delete it or fake it.

What it does is close the door once you get control back. Certificate authorities can reuse a successful domain check for a while. Without a strict record, an attacker who passed a check during the hijack could get more certificates afterwards without touching your DNS again. Google says CAA blocks that, BleepingComputer reports.

That reuse window is long. Under the industry's Baseline Requirements, an authority can reuse a check for up to 200 days. That falls to 100 days in March 2027 and to 10 days in March 2029, The Hacker News reported. Let's Encrypt said in December 2025 that it reuses checks for 30 days and plans to cut that to seven hours by 2028.

Report anything you didn't ask for. Anyone can file a Certificate Problem Report with the authority that issued a certificate. Under the Baseline Requirements, the authority must investigate and report its first findings within 24 hours.