CyberReportedHighDevelopingFeatured

Hackers hijack .gh, .sl, .as ccTLDs, obtain HTTPS certs for Google domains

Threat actors compromised the country-code top-level domains (ccTLDs) .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa), enabling them to issue fraudulent HTTPS certificates for Google domains. The incident underscores systemic weaknesses in ccTLD governance and DNS infrastructure, with potential for targeted interception or impersonation of Google services. Scope and attribution remain unclear.

SecurityWeek2 days agoGH, SL, AS, US, WSengCredibility 26%View source

Score Breakdown

Mosaic Score6.7

Model confidence0.5

Significance0.8

Source credibility0.3

Intelligence Tags

#ccTLD #dns-hijacking #https-certificates #google #infrastructure

Entities

country

Source

Part of 2 situations

activePoliticsJustice2h ago

United States — 230 developments

→ stable·47 signals·US, CU, GH +3Score 5.0

developingCyber2d ago

Threat Actors Hijack ccTLDs (.gh, .sl, .as) to Obtain Rogue HTTPS Certificates for Google Domains

Threat actors compromised third-party operators of the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level domains (ccTLDs), enabling them to alter authoritative DNS records and obtain unauthorized HTTPS certificates for Google domains. This incident confirms a systemic vulnerability in global DNS infrastructure, with potential for large-scale traffic interception and credential theft. The full scope of the compromise and attribution remain unclear.

→ stable·↑2 signals·GH, AS, SL +2Score 4.9