By Global Cybersecurity News Desk
Published: October (Updated)

In a sophisticated wave of domain infrastructure compromises, malicious actors successfully hijacked three prominent country-code top-level domain (ccTLD) registries to generate unauthorized HTTPS certificates for critical Google and YouTube domains. Although Google’s internal enterprise systems remained entirely secure throughout the incident, the breach of external domain registries exposed millions of internet users to potential adversary-in-the-middle (AitM) attacks, highlighting systemic vulnerabilities in the global Domain Name System (DNS) supply chain.

According to disclosures made by Google, the targeted extensions included .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). By illicitly manipulating authoritative DNS records at the registry level, the attackers successfully tricked major public Certificate Authorities (CAs)—namely Let’s Encrypt and ZeroSSL—into validating fraudulent domain ownership. This allowed the perpetrators to obtain cryptographic certificates capable of impersonating trusted Google properties over encrypted HTTPS connections.

Security analysts emphasize that while this incident was rapidly mitigated through automated browser defenses and swift coordination with CAs, it exposes a critical blind spot in how web trust is established, managed, and verified globally.

---

Main Facts: Anatomy of a Registry-Level Compromise

The core vulnerability did not stem from an exploit within Google’s proprietary infrastructure, nor did it involve a technical flaw in the cryptographic algorithms governing TLS/SSL certificates. Instead, the attackers targeted the administrative gatekeepers of national namespaces: the ccTLD registries.

When an entity applies for an SSL/TLS certificate, Certificate Authorities must verify that the applicant possesses administrative control over the target domain. The standard industry validation mechanisms typically require the applicant to place a specific file on a web server, modify a DNS TXT record, or alter authoritative DNS name server records.

During the attacks targeting .gh, .sl, and .as, the threat actors managed to alter the authoritative DNS records for specific high-value domains at the registry level. Armed with unauthorized control over how DNS queries resolved for these zones, the attackers easily satisfied the CAs’ automated domain-validation challenges.

Consequently, between September 22 and September 27, 2025, at least 12 unauthorized cryptographic certificates were issued for core Google and YouTube properties operating under these ccTLDs. These included regional web properties such as:

• google.com.gh and *.google.com.gh
• youtube.com.gh and *.youtube.com.gh
• google.sl, *.google.sl, google.com.sl, and *.google.com.sl
• youtube.sl and *.youtube.sl
• google.as and *.google.as
• youtube.as and *.youtube.as

The Danger of Rogue HTTPS Certificates

An unauthorized HTTPS certificate is a potent weapon in the hands of a cybercriminal. Under normal circumstances, HTTPS encryption guarantees that data transmitted between a user’s browser and a web server is kept private and unalterable. However, if an attacker obtains a valid browser-trusted certificate for a domain they do not own, they can deploy it on a malicious proxy server.

If combined with local network manipulation (such as DNS poisoning or rogue Wi-Fi routing), the attacker can intercept traffic intended for the legitimate site. The user’s browser, seeing a valid, trusted cryptographic certificate matching the domain name, will establish an encrypted connection with the attacker’s server without raising any security warnings. This allows the threat actor to harvest sensitive user credentials, session cookies, and private communications in plaintext.

---

Chronology of the Attack: A Rollout Across Three ccTLDs

Public Certificate Transparency (CT) logs—monitored rigorously by automated threat intelligence platforms such as Cert Spotter and ctlogs.dev—painstakingly recorded the creation and lifecycle of the fraudulent certificates. Security researchers at The Hacker News first surfaced these suspicious records on October 7, revealing a calculated, sequential campaign that rolled out across three distinct geographic domains over a five-day period in late September.

• Phase 1: The Ghana (.gh) Compromise (September 22)
  The campaign kicked off on September 22. At approximately 11:03 UTC, the first fraudulent certificate covering *.youtube.com.gh and youtube.com.gh was logged, issued by Let’s Encrypt. Less than an hour later, at 11:59 UTC, a second Let’s Encrypt certificate was generated for *.google.com.gh and google.com.gh.
• Phase 2: The Sierra Leone (.sl) Sweep (September 25)
  Three days later, the focus shifted to Sierra Leone. Between 04:36 UTC and 06:07 UTC on September 25, a flurry of six certificates was issued under the .sl namespace. Let’s Encrypt issued five of these certificates covering various iterations of Google and YouTube domains (including google.sl, *.google.sl, google.com.sl, *.google.com.sl, youtube.sl, and *.youtube.sl), while ZeroSSL issued a separate certificate specifically targeting google.com.sl and www.google.com.sl.
• Phase 3: The American Samoa (.as) Target (September 27)
  The final phase unfolded on September 27. Between 03:33 UTC and 04:37 UTC, four additional Let’s Encrypt certificates were logged for American Samoa’s ccTLD, encompassing multiple configurations of google.as, www.google.as, and *.youtube.as.

Revocation Timeline

The discovery and remediation timeline varied per certificate, handled rapidly by both the issuing CAs and Google’s automated defense systems:

• September 26: The two .gh certificates and the single ZeroSSL .sl certificate were revoked.
• October 1: The remaining nine .sl and .as certificates were officially revoked by Let’s Encrypt.

Depending on the specific certificate, the gap between initial issuance and ultimate revocation ranged from approximately 36 hours to nearly a full week.

---

Supporting Data: Comprehensive Certificate Audit

Public transparency records provide a granular look at the fraudulent assets generated during the registry hijack campaign. The table below details the specific domain entries, issuing authorities, initial logging timestamps, and subsequent revocation dates.

#	Names on Certificate	Issuer	First Logged (UTC)	Revoked (UTC)
1	*.youtube.com.gh, youtube.com.gh	Let’s Encrypt	Sep 22, 11:03	Sep 26, 02:41
2	*.google.com.gh, google.com.gh	Let’s Encrypt	Sep 22, 11:59	Sep 26, 02:41
3	*.google.sl, google.sl	Let’s Encrypt	Sep 25, 04:36	Oct 1, 19:36
4	google.sl, www.google.sl	Let’s Encrypt	Sep 25, 04:36	Oct 1, 19:36
5	google.com.sl, www.google.com.sl	ZeroSSL	Sep 25, 04:51	Sep 26, 14:56
6	*.google.com.sl, google.com.sl	Let’s Encrypt	Sep 25, 04:51	Oct 1, 19:36
7	www.youtube.sl, youtube.sl	Let’s Encrypt	Sep 25, 06:06	Oct 1, 19:36
8	*.youtube.sl, youtube.sl	Let’s Encrypt	Sep 25, 06:07	Oct 1, 19:36
9	google.as, www.google.as	Let’s Encrypt	Sep 25, 04:51 (Log: Sep 27)	Oct 1, 19:18
10	*.google.as, google.as	Let’s Encrypt	Sep 27, 03:43	Oct 1, 19:18
11	google.as, www.google.as	Let’s Encrypt	Sep 27, 04:17	Oct 1, 19:18
12	*.youtube.as, youtube.as	Let’s Encrypt	Sep 27, 04:37	Oct 1, 19:18

---

Official Responses: Swift Mitigation and Industry Reaction

In its formal security advisory published on October 6, Google confirmed that its internal networks and infrastructure were never breached. However, the tech giant acted swiftly to neutralize the immediate threat to its user base.

Google’s Defensive Action via CRLSets

Google leveraged CRLSets (Certificate Revocation Lists Sets)—a mechanism built into the Google Chrome browser designed to push emergency certificate blocklists directly to client applications without requiring a full software update. Through CRLSets, Chrome immediately blocked the unauthorized certificates from being trusted during connections, safeguarding millions of browser users.

Furthermore, Google collaborated directly with the involved Certificate Authorities (Let’s Encrypt and ZeroSSL) to ensure the fraudulent certificates were globally revoked, protecting users on alternative browsers and applications.

Statements from Certificate Authorities

Matthew McPherrin, speaking on behalf of Let’s Encrypt via the organization’s community forum on October 7, confirmed the issuance and subsequent revocation of the certificates.

"Yes, certificates for Google and YouTube were issued, and have been revoked," McPherrin stated, responding to inquiries from security researchers tracking the anomalous CT logs.

Both Let’s Encrypt and ZeroSSL stressed that their standard validation procedures were executed correctly based on the data presented to them at the time. Because the attackers successfully spoofed authoritative DNS records at the registry level, the automated systems of the CAs had no cryptographic or logical reason to doubt that the entities requesting the certificates were legitimate representatives of the domains.

---

Broader Implications: Beyond Google

While security researchers and media outlets focused heavily on the compromise of Google and YouTube assets, Google’s post-incident analysis revealed a more alarming reality: Google and YouTube were not the only targets.

An examination of Certificate Transparency data strongly indicates that numerous other prominent global brands, corporate entities, and widely utilized online services were similarly caught in the crosshairs of this ccTLD hijacking campaign. Google opted not to publicly name the other impacted organizations to protect their security posture while investigations remain ongoing, but the scope suggests a coordinated, large-scale operation against national domain registries.

Limitations of Browser-Centric Defense

Google’s Chrome Secure Web and Networking Team issued a sobering reminder regarding the limits of browser-based mitigations. While Chrome’s CRLSets effectively blocked the known fraudulent assets, the company noted that DNS hijacks are inherently complex and opaque.

"We cannot guarantee that our analysis identified every affected domain," the Chrome security team wrote, explicitly warning that Chrome’s emergency blocks do not reliably protect individuals utilizing competing web browsers or non-browser applications that lack similar real-time revocation pipelines.

Crucially, as of publication, Google’s disclosures have not clarified whether the unauthorized certificates were actively leveraged in the wild to intercept user traffic, nor have they publicly identified the threat actors behind the operation or confirmed whether the compromised ccTLD registries have fully remediated their underlying infrastructure vulnerabilities.

---

Recommendations: What Domain Owners Must Do

This incident underscores the stark vulnerability of relying solely on standard domain validation and browser protections. Cybersecurity experts and Google have outlined vital defense-in-depth steps for domain administrators to safeguard their digital estates against registry-level tampering.

1. Implement Strict CAA (Certificate Authority Authorization) Records

A Certificate Authority Authorization (CAA) DNS record allows domain owners to declare explicitly which Certificate Authorities are authorized to issue certificates for their domain. If a CA receives a certificate request from an unauthorized entity, a strict CAA record instructs the CA to reject the application.

While a standard CAA record cannot entirely block an attacker from issuing a certificate while an active DNS hijack is underway (as a sophisticated attacker can temporarily alter or delete the CAA record itself), it serves as a crucial post-recovery defense.

Under current industry guidelines, CAs are legally permitted to reuse domain validation checks for extended periods. For instance, the CA/Browser Forum permits CAs to reuse a successful domain validation check for up to 200 days—a timeline scheduled to drop to 100 days by March 2027 and 10 days by March 2029.

Similarly, Let’s Encrypt currently reuses domain validation checks for 30 days, though the organization announced plans to compress this window to just 7 hours by 2028. If an attacker successfully validates a domain during a brief registry hijack, they could theoretically request subsequent certificates long after the initial hijack is mitigated—unless a strict CAA record is enforced.

Following the incident, security audits confirmed that on October 7, all seven affected domains carried strict CAA records enforced via Google Public DNS, pointing exclusively to pki.goog (the proprietary CA of Google Trust Services).

2. Monitor Certificate Transparency Logs Continuously

Organizations should deploy automated monitoring tools that scan public Certificate Transparency logs in real-time. Services such as Cert Spotter, ctlogs.dev, and various commercial monitoring suites alert administrators immediately whenever a new SSL/TLS certificate is issued for their domain names, allowing security teams to catch unauthorized issuances within minutes rather than weeks.

3. Harden Registry-Level Security

For ccTLD registries and domain registrars, this incident serves as a glaring wake-up call. Registries must mandate advanced security controls for administrative accounts, including:

• Mandatory hardware-based Multi-Factor Authentication (MFA) for all registry operators and domain managers.
• Strict implementation of registry locks that prevent unauthorized DNS record modifications without out-of-band verification.
• Enhanced anomaly detection to identify sudden, unauthorized changes to authoritative name server delegations.

As cybercriminals increasingly pivot toward supply-chain attacks targeting foundational internet infrastructure, the defense of global web trust requires active cooperation between domain registries, Certificate Authorities, browser vendors, and enterprise security teams alike.