Emerging ThreatsMalware & Ransomware

Google Domains Targeted in DNS Hijacking Attacks

Analyst 207||Source: TheRegister
Network operations professional surrounded by rows of servers and equipment.

"During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations," Google security warned on Tuesday.

The hijacks in .gh, .sl and .as

Google said it became aware last week of a series of attacks that targeted three country-code top-level namespaces: .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). The company did not disclose which specific Google domains or which other organizations' domains were affected. Google also said the attacks did not compromise Google’s systems.

How attackers combined DNS control with fraudulent TLS certificates

According to Google, attackers changed authoritative DNS records for domains within those ccTLDs and obtained unauthorized HTTPS certificates for several Google domains and for domains belonging to other organizations. Because the attackers controlled DNS routing and held the private keys tied to the unauthorized certificates, they could impersonate legitimate sites without triggering browser security warnings. Google warned this combination "allows criminals to impersonate legitimate organizations and websites" and to intercept or modify data sent by users, or to use the trusted brands to distribute malware or run phishing campaigns.

Chrome's intervention and Google's assessment of certificate authorities

Google said Chrome "quickly blocked suspected counterfeit certificates across the affected ccTLDs," and added that Chrome browser users are already protected. Still, Google cautioned that browser-side measures are not a comprehensive defense: "browser-side intervention should not be relied on to protect your users," and Chrome interventions "do not reliably protect non-Chrome users." Google also stated that, "Due to the nature of the attacks, we have no reason to believe the Certification Authorities (CAs) that issued the impacted certificates did anything wrong."

Google's defensive recommendations for domain operators

To reduce future risk, Google recommended continuous monitoring of Certificate Transparency (CT) logs across all of an organization's domains — including parked names and regional ccTLD properties — to receive near-real-time alerts when any certificate is issued for a domain. For operators of domains in .gh, .sl and .as, Google specifically urged reviewing recent CT log entries for unexpected certificates.

Google also suggested publishing restrictive Certification Authority Authorization (CAA) DNS records, which let domain owners specify which CAs are allowed to issue certificates for their domains. While CAA records "won’t stop certificates from being issued during a DNS hijacking attack," the company said they "help safeguard domains after DNS control is restored." Google recommends CAA policies that restrict issuance to specific authorized accounts and validation methods and that prevent attackers from using cached validation state to mint new certificates after a hijacking ends.

What this means for domain owners, Certificate Authorities, and end users

  • Domain owners: Operators with properties in .gh, .sl and .as should review recent Certificate Transparency logs for unexpected issuance, adopt restrictive CAA records, and treat browser-blocking as an emergency mitigation rather than a full cure.
  • Certificate Authorities (CAs): Google expressed no reason to blame issuing CAs in these incidents, but the events underline the value of coordination with domain owners and real-time CT visibility to detect and mitigate unauthorized issuance quickly.
  • End users: Chrome users saw suspected counterfeit certificates blocked quickly; Google warned, however, that protections vary by browser and that Chrome interventions "do not reliably protect non-Chrome users."

The incidents in .gh, .sl and .as underline a simple but consequential truth: control of DNS can be as powerful as control of servers. Google’s public guidance focuses on detection (CT logs) and post-incident hardening (CAA policies and restricted validation) rather than assigning blame for issuance. For domain operators and certificate issuers alike, the next practical steps are clear — tighten who can obtain certificates for your names, watch CT logs continuously, and assume browser blocking will not shield every user.

Original story

Emerging ThreatsDNS HijackingGhanaGoogle DomainsHTTPS Certificate AbuseCountry-Code TldsDomain Name SystemTLS Certificate FraudSierra LeoneAmerican Samoa
Related Intelligence

Continue Reading

Network equipment and security appliances on racks with a Fortinet device centered.

FBI Warns of Ongoing FortiBleed Attacks Targeting Fortinet VPN Admins

Tens of thousands of Fortinet FortiGate firewalls and SSL VPN gateways are under active attack by hackers leveraging a massive June credential leak, putting countless networks at risk of disruption. The breach, known as FortiBleed, exposed a staggering 73,932 firewall URLs across 194 countries, giving attackers a treasure trove of vulnerable targets.

Analyst 207
Neutral background with rows of generic computer servers and monitoring equipment.

Hackers Exploit ccTLD Vulnerabilities to Hijack Google Domains

Google revealed that several top brands and online services were hit by the same attacks, following their initial mitigation efforts. Attackers exploited vulnerabilities in country-code top-level domain (ccTLD) registries and DNS to hijack Google domains, not by breaching Google's infrastructure, but by compromising third-party operators.

Analyst 207
Domain management office with computer workstations and a large map in the background.

Hackers Hijack Country-Code Domains to Obtain Google HTTPS Certificates

Hackers hijacked country-code domains to obtain unauthorized Google HTTPS certificates, putting several domains at risk between September 22 and 27. Google quickly sprang into action, revoking the certificates and blocking them in Chrome to prevent any further damage.

Analyst 207
Software development workspace with laptop, coding books, and blurred npm registry webpage on screen.

Malicious npm Packages Deliver Overlord RAT and Stealer in Supply Chain Attack

A single malicious npm package, "function-flag," was downloaded a staggering 37,419 times in a supply-chain operation that delivered Remote Access Trojans and information stealers to Windows hosts. This was part of a larger campaign, dubbed MALFEX, where 12 packages were published to the npm registry since August 2023, with eight of them flagged as malicious and collectively downloaded over 40,767 times.

Analyst 207