Attackers hijacked three country-code top-level domains (.gh,.sl,.as) and used that control to issue counterfeit TLS certificates for Google and other large organizations, Google announced Tuesday.
The attackers modified authoritative DNS records within these namespaces after gaining control of the top-level domains. This allowed them to bypass automated domain control validation checks, leading to the issuance of unauthorized certificates for several Google domains and other leading global brands and widely used online services.
TLS certificates are cryptographic credentials that secure websites, mail servers and other internet infrastructure. These x.509 certificates digitally bind a domain name—such as google.com—to a public key. Unauthorized certificates enable attackers to cryptographically impersonate affected infrastructure, undermining encryption protections.
Google responded by updating its Chrome browser to block all certificates identified as unauthorized and collaborated with certification authorities to revoke the unauthorized certificates for Google properties.
But Google cautioned domain owners against relying solely on browser-side protections. The company advised domain owners to actively monitor certificate transparency logs for unexpected certificate issuance and publish restrictive Certification Authority Authorization (CAA) DNS records to prevent attackers from reusing cached validation data after DNS control is restored.
Google acknowledged the limits of its mitigation efforts. Browser interventions do not reliably protect non-Chrome users. The revocation process remains slow, despite quicker browser-level blocking. The company cannot guarantee its analysis identified every affected domain, and any undiscovered unauthorized certificates continue to pose a threat.
The identities of the other affected organizations and the total number of unauthorized certificates issued remain undisclosed.
