Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers compromised the administrative infrastructure of three country-code top-level domain (ccTLD) registries, exploiting weaknesses in registry access controls and DNS management to fraudulently obtain HTTPS certificates for high-profile domains owned by Google. This attack demonstrates that the certificate trust model is only as strong as the weakest DNS authority in the chain — a compromised registry can undermine the integrity of encrypted communications globally. Because HTTPS certificates are widely trusted by browsers by default, end users would have had no visual warning that they were connecting to an impersonator. Google's rapid response using CRLSets and coordinated certificate revocation limited real-world harm, but the window of exposure highlights how critical timely detection and revocation mechanisms are. Organizations cannot rely solely on certificate issuance controls; they must actively monitor for unauthorized certificates referencing their domains.