Affected Systems

Domains under .GH (Ghana), .AS (American Samoa), and .SL (Sierra Leone) ccTLDs. Google domains and multiple global brands affected. Third-party registry operators for these ccTLDs were compromised. Chrome users protected via CRLSets; other browsers potentially vulnerable.

Exploitation Status

Active exploitation confirmed. Attackers compromised third-party ccTLD registry operators, modified authoritative DNS records, and obtained unauthorized HTTPS certificates from legitimate Certificate Authorities. Google blocked certificates via CRLSets and worked with CAs to revoke them.

Business Impact

Attackers gained ability to impersonate legitimate domains by controlling DNS records and obtaining valid TLS certificates. This enabled man-in-the-middle attacks, phishing, and serving malicious content under trusted brand names. Chrome users are protected via CRLSets, but users of Firefox, Safari, Edge, and other browsers remain at risk. Google cannot guarantee all affected domains have been identified. No compromise of Google's internal systems occurred.

Urgency

đź”´ Immediate

Recommended Actions

  • Monitor Certificate Transparency (CT) logs for all domains in your portfolio, including parked domains, to detect unauthorized certificate issuance
  • Publish restrictive CAA (Certification Authority Authorization) DNS records to limit certificate issuance to authorized ACME accounts and validation methods
  • If you manage domains under .GH, .AS, or .SL ccTLDs, immediately verify DNS records for unauthorized modifications and review recent certificate issuance
  • Advise end users to use Chrome or verify that other browsers have received updated certificate revocation lists from affected CAs
  • Contact your domain registrar to confirm the security posture of registry operators and enable available registry-lock or DNSSEC protections

---

# Geopolitical Context

Geopolitical Context

The compromise of third-party country-code top-level domain (ccTLD) registry operators for Ghana (.GH), Sierra Leone (.SL), and American Samoa (.AS) represents a significant supply chain vulnerability affecting global internet infrastructure. By gaining unauthorized access to authoritative DNS records at the registry level, threat actors were able to obtain valid HTTPS certificates for Google and other major brands' domains, enabling sophisticated impersonation attacks. This incident highlights the strategic risk posed by weakly secured national domain infrastructure, particularly in smaller jurisdictions that may lack resources for robust cybersecurity controls. The attack vector—exploiting trust relationships between Certificate Authorities, DNS operators, and domain registrants—demonstrates how adversaries can weaponize legitimate internet governance mechanisms. The targeting of multiple geographically dispersed ccTLD operators suggests either a coordinated campaign or exploitation of common vulnerabilities in shared registry platform providers.

State Actor Alignment

No attribution to state actors has been provided in available reporting. The technical sophistication required to compromise multiple ccTLD registry operators and orchestrate certificate issuance across jurisdictions is consistent with capabilities possessed by both advanced persistent threat (APT) groups and organized cybercrime syndicates. The choice of targets—smaller nations' ccTLD infrastructure rather than direct attacks on major technology companies—may indicate adversaries seeking to exploit weaker links in the global DNS trust chain. The incident's focus on obtaining valid certificates for impersonation rather than data exfiltration or disruption could suggest commercial fraud motives, though espionage or pre-positioning for future operations cannot be excluded. U.S. authorities and international bodies such as ICANN may investigate whether this represents a broader pattern of attacks on domain registry infrastructure.

Business Impacty pro region

This incident exposes critical vulnerabilities in internet governance infrastructure across developing regions, particularly in West Africa and Pacific territories. Ghana and Sierra Leone's ccTLD compromises may prompt increased scrutiny of African digital infrastructure security and could accelerate calls for technical assistance from international partners. For American Samoa, a U.S. territory, the breach raises questions about oversight of critical internet infrastructure in non-state jurisdictions. European organizations and users accessing affected domains faced potential exposure to man-in-the-middle attacks, though Google's rapid certificate blocking through CRLSets mitigated immediate risks for Chrome users. The incident may strengthen arguments within the European Union and other regions for greater regulatory oversight of domain registries and Certificate Authorities, potentially influencing ongoing digital sovereignty debates. Globally, the attack underscores dependencies on third-party registry operators and may accelerate adoption of DNS security extensions (DNSSEC) and stricter CAA record policies among multinational enterprises.

Forecast

If additional ccTLD registry compromises are discovered in coming weeks, expect heightened international attention to domain infrastructure security standards, potentially leading to ICANN policy reviews or technical assistance programs for under-resourced registry operators. Should attribution emerge linking the attacks to state-sponsored actors, affected nations may face diplomatic pressure or technical sanctions. In the near term, major technology companies and financial institutions are likely to accelerate implementation of restrictive CAA records and enhanced monitoring of Certificate Transparency logs across their domain portfolios. If the attack vector involved a common third-party registry platform provider, expect vendor disclosure and potential coordinated patching efforts across multiple ccTLD operators. Browser vendors beyond Google may implement similar emergency certificate blocking mechanisms, potentially fragmenting trust decisions across the ecosystem. Organizations operating in or serving users from affected ccTLD jurisdictions should anticipate increased due diligence requirements from partners and customers regarding domain security controls.