Hackers Hijacked Three Country Registries to Get Real Certificates for Google

Attackers have taken over the registries behind three country-code domains and used them to get real HTTPS certificates for Google and YouTube. Google disclosed the ccTLD registry hijack on 6 October 2026. The affected registries run .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). Google says its own systems were not breached, but the trick did not need them to be.

What happened in the ccTLD registry hijack

A registry holds the master records for every domain under its suffix. According to Google’s Chrome team, the attackers changed the authoritative DNS records for domains in those three suffixes. That let them point names such as google.com.gh at servers they controlled.

Then they asked certificate authorities for certificates. Those authorities check that an applicant controls a domain, usually by looking at DNS. If you control the DNS, you pass the test. The checks worked as designed. The thing they relied on had been tampered with.

Google said it has no reason to believe the issuing authorities did anything wrong.

The certificates, by the numbers

Google did not publish a count. The Hacker News went looking in public Certificate Transparency logs and found at least 12 certificates for Google and YouTube names, covering seven domains. They were logged between 22 and 27 September. Let’s Encrypt issued 11 and ZeroSSL issued one.

Every other certificate for those names since at least 10 September came from Google Trust Services. That sudden change of issuer is exactly the sort of signal a monitor can catch.

Let’s Encrypt confirmed the issue on its community forum on 7 October. Staff member Matthew McPherrin wrote that certificates for Google and YouTube were issued, and have been revoked. The Hacker News found the .gh certificates and the ZeroSSL one were revoked on 26 September. The other nine followed on 1 October.

Google’s own list is longer

The logs also showed other victims. Google says they include “several leading global brands and widely used online services”. It did not name them. Chrome blocked those certificates too and contacted the owners where it could.

Chrome users did not need to do anything, because the browser pushed the block out through CRLSets, its own revocation list. Other browsers and clients rely on the authorities revoking the certificates. Google also warned it cannot guarantee it found every affected domain.

What we still do not know

The gaps are large. Google did not say how the registries were compromised, who did it, or whether the registries are now secure. It did not say whether anyone used a certificate to impersonate a site or read user data.

That matters if you own a domain under one of these suffixes. Treat the hijack as live until the registries say otherwise.

Why this ccTLD registry hijack matters for your business

Most firms assume that a padlock plus the right domain means safety. This incident breaks the link between the two. A certificate proves someone controlled the DNS at one moment. It says nothing about who owned the name yesterday.

It also shows where the weak point sits. You can patch every server and still lose a domain because a third party up the chain was compromised. Your registrar, your registry and your DNS host all sit above your firewall.

We made a similar point about trusting a domain name on its own. Attackers keep finding ways to borrow credibility rather than break in.

What to check this week

None of this needs a large budget. Start with these steps:

• List every domain you own. Include parked names and regional variants. Forgotten domains are the ones nobody watches.
• Watch Certificate Transparency. Set up alerts so you hear about any certificate issued for your names. Google points to public monitoring services for this.
• Publish strict CAA records. These DNS records name the authorities allowed to issue for you. Google also recommends binding them to your own account, as described in RFC 8657.
• Know the limit of CAA. It cannot stop issuance while an attacker controls your DNS, because they can edit the record. It does stop an authority reusing an old domain check after you regain control.
• Report unrequested certificates. The issuing authority must investigate and give initial findings within 24 hours under the industry Baseline Requirements.

Shorter validation reuse is coming too. The current limit of 200 days falls to 100 days in March 2027 and to 10 days in March 2029.

Where testing fits after a ccTLD registry hijack

A review of your external footprint should catch the forgotten domain, the stale DNS record and the missing CAA entry. It is the same ground we cover in our guide to external attack surface management. A web application penetration test then checks what an attacker could do with a trusted name once they hold it.