[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiR6LzojyBySDfT6pzomu2flCluAaMoKIfxEdRH1sa3E":3},{"article":4,"iocs":49,"watch_terms":74,"solutions":75,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"382e36d6-7eb7-46ee-af72-54406771ca8f","Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains","attackers-hijack-gh-sl-and-as-registries-to-obtain-certificates-for-google-domai-d19160","Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an encrypted","Attackers compromised the domain registries for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) to obtain unauthorized HTTPS certificates for Google and YouTube domains. While Google's own systems were not breached, these certificates could have allowed attackers to impersonate legitimate sites over encrypted connections. Google blocked the unauthorized certificates via CRLSets and worked with certificate authorities to revoke them, mitigating the risk.","Attackers hijacked .gh, .sl, and .as domain registries to obtain unauthorized HTTPS certificates for Google domains.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-hijack-gh-sl-and-as.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhlqu6e-ijwp1hAEuYyfUUL9hV5kwu0cIe1cMibzayov0GdV2FkSpwvF10YKcxLyw1AUNdKF54RV9o3bfeshwWIWdda1AvgNm4iu6t9F16pb1jOVDQRXBoRjw2uueD4Ov7oEzjPJV7pXgK1U-MzkkqRKgHqP207GG2pqtkRQ09IVZ94HvSlBVArvu7tkNE\u002Fs1600\u002Fgoogle-tls.jpg","2026-10-07T18:48:17+00:00","2026-10-07T20:00:12.932024+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"Google Domains","product",{"name":24,"type":22},"YouTube",{"name":26,"type":22},"Chrome",{"name":28,"type":22},"Let's Encrypt",{"name":30,"type":22},"ZeroSSL","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[50,54,56,58,60,62,64,66,68,70,72],{"type":51,"value":52,"context":53},"domain","google.com.gh","Domain for which unauthorized certificate was issued",{"type":51,"value":55,"context":53},"google.sl",{"type":51,"value":57,"context":53},"google.as",{"type":51,"value":59,"context":53},"youtube.com.gh",{"type":51,"value":61,"context":53},"google.com.sl",{"type":51,"value":63,"context":53},"www.google.com.sl",{"type":51,"value":65,"context":53},"www.google.sl",{"type":51,"value":67,"context":53},"www.youtube.sl",{"type":51,"value":69,"context":53},"youtube.sl",{"type":51,"value":71,"context":53},"www.google.as",{"type":51,"value":73,"context":53},"youtube.as",[18,21,24],{"controls":76,"vendors":157},[77,106,133],{"slug":78,"name":79,"problem":80,"products":81},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"slug":107,"name":108,"problem":109,"products":110},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":128,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":128,"url":131,"description":132},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":35,"name":134,"problem":135,"products":136},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[137,144,152],{"vendor_slug":138,"vendor_name":18,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":153,"product_name":154,"url":155,"description":156},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[158],{"slug":138,"name":18,"logo_path":139,"roles":159},[160,161],"reported_by","affected",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":178},"hijacked-country-code-registries-used-to-issue-fraudulent-tls-certificates","Hijacked Country-Code Registries Used to Issue Fraudulent TLS Certificates","Attackers compromised the administrative infrastructure of three country-code top-level domain (ccTLD) registries, exploiting weaknesses in registry access controls and DNS management to fraudulently obtain HTTPS certificates for high-profile domains owned by Google. This attack demonstrates that the certificate trust model is only as strong as the weakest DNS authority in the chain — a compromised registry can undermine the integrity of encrypted communications globally. Because HTTPS certificates are widely trusted by browsers by default, end users would have had no visual warning that they were connecting to an impersonator. Google's rapid response using CRLSets and coordinated certificate revocation limited real-world harm, but the window of exposure highlights how critical timely detection and revocation mechanisms are. Organizations cannot rely solely on certificate issuance controls; they must actively monitor for unauthorized certificates referencing their domains.",[167,168,169,170,171,172,173,174,175,176,177],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 SC-20 (Secure Name\u002FAddress Resolution Service)","NIST SP 800-53 IR-4 (Incident Handling)","NIST Cybersecurity Framework DE.CM-7 (Monitoring for Unauthorized Activity)","RFC 6844 – DNS Certification Authority Authorization (CAA)","RFC 6962 – Certificate Transparency","ITIL Service Continuity Management – Recovery and Response Procedures",{}]