[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-G9eCQupna5nGoGm7z-bpfsosl488ziL2kIxSmI4yqE":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"4ed6fd76-a5ee-4908-8754-34ee91e763be","Hackers hijack Google domains after breaching ccTLD registries","hackers-hijack-google-domains-after-breaching-cctld-registries-7f3dc4","Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. [...]","Attackers compromised third-party operators of ccTLD registries for Ghana, American Samoa, and Sierra Leone, allowing them to modify DNS records and obtain unauthorized HTTPS certificates for Google domains. While Google's systems were not directly breached, the attackers could impersonate legitimate brands and serve malicious content. Google has since blocked the unauthorized certificates in Chrome and is working with affected organizations and CAs.","Hackers compromised ccTLD registries, obtaining unauthorized HTTPS certificates for Google domains.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-hijack-google-domains-after-breaching-cctld-registries\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F12\u002F29\u002Fgoogle-flare.jpg","2026-10-07T20:50:13+00:00","2026-10-07T22:00:04.041307+00:00",8,[17,20],{"name":18,"type":19},"Chrome","product",{"name":21,"type":22},"Google","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[21,18],{"controls":49,"vendors":136},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"slug":27,"name":80,"problem":81,"products":82},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":108,"name":109,"problem":110,"products":111},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[137],{"slug":138,"name":21,"logo_path":139,"roles":140},"google","\u002Fvendor-logos\u002Fgoogle.png",[141,142],"reported_by","affected",{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"cctld-registry-breaches-enable-dns-hijacking-of-google-domains","ccTLD Registry Breaches Enable DNS Hijacking of Google Domains","Attackers exploited weaknesses in third-party ccTLD registry operators to manipulate DNS records and fraudulently obtain HTTPS certificates for Google-owned domains — a classic supply chain attack where trust in a delegated third party becomes the attack surface. The root cause lies in insufficient security controls at these registries, which act as critical internet infrastructure but may not be held to the same security standards as the organizations whose domains they manage. This matters because even a well-secured organization like Google can have its domains impersonated through no direct fault of its own, undermining the foundational trust model of the web's certificate and DNS ecosystem. The incident highlights that certificate transparency logging and browser-level certificate blocking, while effective reactive measures, are no substitute for proactive security at every link in the DNS chain.",[148,149,150,151,152,153,154,155,156,157],"CIS Control 12: Network Infrastructure Management","CIS Control 15: Service Provider Management","NIST SP 800-53 SC-20: Secure Name\u002FAddress Resolution Service (Authoritative Source)","NIST SP 800-53 SC-21: Secure Name\u002FAddress Resolution Service (Recursive or Caching Resolver)","NIST SP 800-53 SA-9: External System Services","NIST CSF ID.SC-2: Suppliers and third-party partners of information systems are identified, prioritized, and assessed","NIST CSF DE.CM-1: The network is monitored to detect potential cybersecurity events","RFC 9162: Certificate Transparency Version 2.0","GDPR Article 32: Security of Processing (for EU-domain operators subject to GDPR)","ITIL 4: Supplier Management Practice",{}]