Full Report
In other news: Hackers breach TLD registrars to get Google certs; Qilin member arrested in Japan; Google suspends OSS VRP due to AI spam.
Analysis Summary
# Incident Report: Multi-Registry ccTLD Hijacking & Certificate Fraud
## Executive Summary
A sophisticated threat actor successfully hijacked three country-code Top-Level Domain (ccTLD) registries—American Samoa (.as), Ghana (.gh), and Sierra Leone (.sl). By gaining control of these registries, the attackers manipulated DNS records to bypass ownership validation and obtain unauthorized HTTPS certificates for targeted domains, including those belonging to Google. The incident highlights a critical systemic vulnerability in the trust chain of global DNS infrastructure.
## Incident Details
- **Discovery Date:** Reported October 12, 2026 (via Google Security)
- **Incident Date:** September–October 2026
- **Affected Organization:** Multiple, including Google and other unnamed organizations.
- **Sector:** Technology / Critical Internet Infrastructure
- **Geography:** Global impact; Registries located in American Samoa, Ghana, and Sierra Leone.
## Timeline of Events
### Initial Access
- **Date/Time:** Circa September 2026
- **Vector:** Breach of ccTLD Registry Management Systems.
- **Details:** The threat actor gained unauthorized access to the administrative interfaces or infrastructure of the registries for .as, .gh, and .sl.
### Lateral Movement
- **Details:** Once registry access was achieved, the attackers moved to manipulate the zone files of high-value domains hosted within those TLDs.
### Data Exfiltration/Impact
- **Impact:** Attackers modified DNS records (likely TXT or CNAME records) to satisfy Domain Control Validation (DCV) requirements. This allowed them to issue valid, trusted HTTPS certificates for domains they did not own, facilitating potential Man-in-the-Middle (MitM) attacks.
### Detection & Response
- **Discovery:** Detected by Google’s security monitoring (likely via Certificate Transparency log monitoring).
- **Response:** Google published a security advisory; Chrome and other browsers likely revoked the fraudulent certificates and worked with registries to restore authorized DNS records.
## Attack Methodology
- **Initial Access:** Hijacking of registry-level administrative accounts or exploitation of registry software vulnerabilities.
- **Persistence:** Maintaining control over DNS zone files.
- **Privilege Escalation:** Elevating from a standard user to a registry administrator capable of modifying TLD zone files.
- **Defense Evasion:** Using legitimate Domain Control Validation (DCV) processes to obtain "legal" certificates from Certificate Authorities (CAs).
- **Discovery:** Identifying high-value targets (e.g., Google services) residing within the compromised TLDs.
- **Lateral Movement:** Not applicable in a traditional network sense; movement was via cross-domain DNS record manipulation.
- **Impact:** Strategic compromise of the TLS/SSL trust model via DNS hijacking.
## Impact Assessment
- **Financial:** High potential cost for remediation and monitoring by affected parties like Google.
- **Data Breach:** Risk of intercepted encrypted traffic (credentials, cookies, PII) via MitM.
- **Operational:** Disruption to the integrity of the global DNS system.
- **Reputational:** Significant damage to the trust of the affected ccTLD registries.
## Indicators of Compromise
- **Behavioral indicators:**
- Unauthorized changes to DNS NS or DS records at the TLD level.
- Unexpected TXT records used for ACME/DCV validation.
- Certificates issued by CAs that are not part of the organization's standard procurement policy.
## Response Actions
- **Containment:** Coordination with the impacted registries to lock administrative accounts and revert DNS changes.
- **Eradication:** Revocation of all fraudulently obtained TLS certificates via CRL and OCSP.
- **Recovery:** Implementation of Multi-Factor Authentication (MFA) and stricter access controls at the registry level.
## Lessons Learned
- **Registry Fragility:** The security of a domain is only as strong as the TLD registry it sits under.
- **DCV Limitations:** Traditional DNS-based Domain Control Validation is vulnerable if the underlying DNS infrastructure is compromised.
- **CT Monitoring:** Certificate Transparency (CT) logs are vital for early detection of unauthorized certificate issuance.
## Recommendations
- **For Domain Owners:** Enable **CAA (Certificate Authority Authorization)** records to restrict which CAs can issue certificates for your domains.
- **For Registries:** Implement **Registry Lock** services and mandate hardware-based MFA for all administrative access.
- **Monitoring:** Implement real-time monitoring of Certificate Transparency logs for all corporate-owned domains.