{"id":4824,"date":"2026-10-08T07:41:05","date_gmt":"2026-10-08T07:41:05","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=4824"},"modified":"2026-10-08T07:42:42","modified_gmt":"2026-10-08T07:42:42","slug":"attackers-hijack-3-country-code-registries-obtain-google-certificates","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/attackers-hijack-3-country-code-registries-obtain-google-certificates\/","title":{"rendered":"Attackers Hijack 3 Country-code Registries, Obtain Google Certificates"},"content":{"rendered":"\n

Google revealed on October 6, 2026<\/strong> that attackers have hijacked the administrators of three country-code domain registries to get illegitimate HTTPS certificates for a number of Google sites and other domain names. Google said it<\/a> blocked the certificates in Chrome and that its own systems were not breached.<\/em><\/p>\n\n\n\n

What was targeted<\/h2>\n\n\n\n

A country-code top-level domain (ccTLD) is the domain ending that\u2019s assigned to countries or territories, such as .co. The affected ones are .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)<\/strong>. They’re all at risk if registry operators are compromised, whether the domain is owned by a different person.<\/p>\n\n\n\n

HTTPS certificates<\/a> are digital certificates that enable browsers to verify the identity of a site and encrypt a website’s traffic. They are certificates issued by a certificate authority (CA) following confirmation that the requester owns the domain.<\/p>\n\n\n\n

Also Read:<\/strong> What is DNS Poisoning or DNS Spoofing?<\/a><\/p>\n\n\n\n

The way the Attack came about<\/h2>\n\n\n\n

The attackers changed authoritative DNS records, authoritative parts of a domain, then got the unauthorised certificates, Google said. Ownership is normally confirmed by having the requester publish a random value provided by a CA in DNS. <\/p>\n\n\n\n

Usual steps to verify ownership involve requesting the value from the CA and the requester publishing the CA-supplied random value in DNS. Mitigating the records control, therefore, allows an attacker to pass that check if a domain isn’t theirs to control.<\/p>\n\n\n\n

The outlet also said that<\/strong> the access would enable attackers to refer the businesses to infrastructure they controlled, to enable them to impersonate brands. Google’s announcement maintains the lens on whether the certificates were installed to spy on communications or contents remains unclear, CyberInsider added<\/a>.<\/p>\n\n\n\n

Response and Unknowns<\/h2>\n\n\n\n

Google was made aware of the hijacks \u201clast week,\u201d<\/strong> the company said. But it has prevented the Chrome browser from rejecting revoked certificates via CRLSets<\/strong>, a list maintained by the browser to identify them. It also acted on behalf of the issuing CAs to revoke their CA certificates, thereby adding protection for other clients of the CAs.<\/p>\n\n\n\n

Other entities, such as major global brands and popular online services, were uncovered by the Certificate Transparency logs<\/a>, public records of issued certificates. Google restricted those certificates in Chrome and notified the organisations as far as possible. Users of Web browsers other than Chrome don’t need to do anything.<\/p>\n\n\n\n

Several facts were not made public:<\/strong> How the registries were compromised, who is responsible, when the attacks started, and how many certificates were issued were not made public, and whether control of the registries has been restored remains silent. <\/p>\n\n\n\n

Google also added<\/strong>, “We cannot ensure that we have identified all impacted domains. These blocks are not always effective in blocking other browsers, and the sources state that they don’t know if there were any certificates revoked for the non-Google organisations.<\/p>\n\n\n\n

What Should Domain Owners do<\/h2>\n\n\n\n