Affected Systems

All domains under .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs. Confirmed fraudulent certificates issued for Google and YouTube domains between September 22-27, 2026. At least 12 unauthorized certificates issued by Let's Encrypt (11) and ZeroSSL (1). Other global brands and online services also believed affected but not publicly named.

Exploitation Status

Active exploitation confirmed. Attackers compromised DNS authoritative records at registry level between September 22-27, 2026, and successfully obtained domain-validated HTTPS certificates from legitimate CAs. Certificates were revoked September 26 - October 1. No confirmation whether certificates were used in active man-in-the-middle attacks to intercept user data.

Business Impact

Organizations with domains under .gh, .sl, or .as ccTLDs face risk of impersonation attacks via fraudulent SSL certificates. Attackers with valid certificates can conduct man-in-the-middle attacks, intercept encrypted traffic, and steal credentials or sensitive data. Chrome users protected via CRLSets blocking, but users of other browsers and applications remain vulnerable until certificates revoked. Registry-level compromise means all domains under these TLDs were at risk regardless of individual domain security posture. Google blocked known fraudulent certificates but cannot guarantee complete identification of all affected domains.

Urgency

đź”´ Immediate

Recommended Actions

  • Immediately audit Certificate Transparency logs for all domains under .gh, .sl, and .as ccTLDs using ctlogs.dev or Cert Spotter to identify unauthorized certificates issued between September 22-27, 2026
  • Implement Certificate Transparency monitoring with automated alerting for all owned domains, including parked and regional ccTLD variants, to detect future unauthorized certificate issuance
  • Publish strict CAA DNS records for all domains specifying authorized CAs and account-binding where supported to prevent unauthorized certificate issuance during future DNS hijacks
  • File Certificate Problem Reports with Let's Encrypt or ZeroSSL if unauthorized certificates discovered for your domains; CAs must investigate within 24 hours per Baseline Requirements
  • Review DNS configuration and registrar security controls for domains under affected ccTLDs; consider migrating critical services away from .gh, .sl, and .as TLDs if registry security cannot be verified

---

# Geopolitical Context

Geopolitical Context

The compromise of three country-code top-level domain (ccTLD) registries—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—represents a supply chain attack targeting critical internet infrastructure. Between September 22–27, 2026, attackers manipulated authoritative DNS records to obtain fraudulent HTTPS certificates for Google and YouTube domains, as well as other unnamed global brands. This incident highlights systemic vulnerabilities in the global domain name system, particularly affecting smaller jurisdictions with limited cybersecurity capacity. The sequential nature of the attacks—.gh on September 22, .sl on September 25, .as on September 27—suggests a coordinated campaign exploiting governance gaps in ccTLD administration. While no attribution has been provided, the targeting of internet infrastructure in West Africa and U.S. territories raises questions about whether this represents opportunistic cybercrime, espionage preparation, or testing of techniques for future man-in-the-middle operations against high-value targets.

State Actor Alignment

No state actor attribution has been disclosed by Google or affected parties. The incident appears consistent with either sophisticated cybercriminal activity seeking to enable financial fraud or information theft, or with state-sponsored reconnaissance and capability development for future espionage operations. The choice of targets—small jurisdictions with limited cyber defense resources managing ccTLDs used by major global technology companies—may indicate adversary interest in exploiting trust relationships within the certificate authority ecosystem. The United States, through ICANN oversight and the Department of Homeland Security's CISA, maintains policy influence over global DNS governance, and American Samoa's status as a U.S. territory may trigger federal incident response coordination. Ghana and Sierra Leone, as sovereign nations with independent registry operations, would be expected to conduct their own investigations, potentially with support from regional bodies such as ECOWAS or international partners.

Business Impacty pro region

This incident exposes critical infrastructure vulnerabilities in developing regions where ccTLD registries may lack resources for advanced threat detection and response. For West Africa, the compromise of Ghanaian and Sierra Leonean registries underscores the region's exposure to supply chain attacks targeting digital infrastructure, potentially undermining confidence in local internet governance and e-commerce. The involvement of American Samoa, a U.S. territory, internationalizes the incident and may prompt U.S. federal agencies to assess risks to other territorially-administered ccTLDs (.pr, .vi, .gu). For Europe and other developed regions, the incident demonstrates that geographic diversification of domain registrations—often pursued for regulatory or market access reasons—can introduce unexpected security dependencies on jurisdictions with varying cybersecurity maturity. Global certificate authorities, including Let's Encrypt and ZeroSSL, face renewed scrutiny over domain validation procedures, as the attackers successfully obtained certificates through legitimate CA processes by manipulating upstream DNS infrastructure. The incident may accelerate policy discussions within ICANN, the ITU, and regional internet governance bodies regarding minimum security standards for ccTLD operators.

Forecast

If the compromised registries have not implemented comprehensive security remediation, additional fraudulent certificates may surface in Certificate Transparency logs in coming weeks, potentially affecting organizations beyond those already identified. If the attackers retain access to registry infrastructure, they could pivot to more targeted operations against financial institutions, government services, or critical infrastructure providers using affected ccTLDs. Certificate authorities are likely to face pressure from browser vendors and the CA/Browser Forum to enhance domain validation procedures, possibly including out-of-band verification for high-value domains or automated CT log monitoring with rapid revocation triggers. If this incident is linked to state-sponsored activity through subsequent investigation, affected countries may seek technical assistance from U.S. Cyber Command, CISA, or European partners to secure registry infrastructure and conduct forensic analysis. Organizations with domain holdings under .gh, .sl, and .as should anticipate heightened scrutiny from security teams and may consider migrating critical services to ccTLDs with stronger security track records, potentially accelerating consolidation around well-resourced registry operators.