Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

The Hacker News reported on 6 October that threat actors gained control of the registry operators for the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) country‑code top‑level domains (ccTLDs). By exploiting the registries’ certificate‑issuing processes, the attackers were able to obtain valid TLS certificates for a range of Google‑owned domains.

The illicit certificates were issued by a publicly trusted Certificate Authority, allowing the attackers to present seemingly legitimate encrypted connections for any website ending in the compromised ccTLDs. This technique does not require a breach of Google’s own infrastructure; instead it leverages the trust relationship between domain registries and certificate authorities.

For Australian users and enterprises that rely heavily on Google services such as Search, Workspace and Cloud, the incident raises concerns because a forged certificate could be used to conduct man‑in‑the‑middle attacks, phishing, or malware distribution, particularly if users are directed to a .gh, .sl or .as address that mimics a legitimate Google site.

Google responded by revoking the fraudulent certificates and notifying affected parties. The company also worked with the compromised registries to tighten their validation procedures and urged users to verify certificate details, especially when accessing services from unfamiliar domain extensions.

The episode underscores the importance of robust PKI hygiene and regular security training for IT professionals. In Australia, organisations are reminded to monitor certificate usage and educate staff on spotting spoofed sites. Wepro Technology offers courses such as Security+ and Network+ that cover these topics, helping professionals stay ahead of emerging threats.