Date: October 10, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Threat Intelligence / Internet Infrastructure / DNS Security / Cryptographic Trust
Tags: Google, DNS Hijacking, ccTLD, Let's Encrypt, ACME, TLS Certificates, SecurityWeek, Google Threat Intelligence
Executive Summary
On October 9–10, 2026, internet routing and core cryptographic trust faced an unprecedented security disclosure as SecurityWeek and Google Threat Intelligence revealed that sophisticated threat actors successfully hijacked the centralized registry infrastructure of three country-code top-level domains (ccTLDs). The compromised registries included Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as).
By infiltrating the authoritative registry management systems responsible for managing these national top-level domains, the attackers altered authoritative Name Server (NS) and DNSSEC delegation records for high-profile domains, including localized country domains operated by Google (such as google.com.gh and google.com.sl). Armed with temporary DNS control, the attackers leveraged automated Automated Certificate Management Environment (ACME) validation challenges to mint legitimate, publicly trusted HTTPS/TLS certificates for Google domain names. The attack allowed the adversaries to conduct large-scale, cryptographic Adversary-in-the-Middle (AiTM) traffic interception against government, enterprise, and civil society users without triggering browser certificate warnings.
Deep-Dive Technical Breakdown of the ccTLD Registry Hijack
The attack bypassed corporate perimeter defenses by striking at the apex of the internet's hierarchical Domain Name System (DNS):
1. Infiltration of National ccTLD Registry Systems
Top-level domain registries manage the authoritative delegation records for an entire nation's internet space:
* The Registry Breach Vector: Threat actors compromised administrative user accounts or exploited web vulnerabilities in the registry management software operated by national telecommunications authorities managing .gh, .sl, and .as.
* Authoritative Delegation Tampering: Rather than poisoning local DNS resolver caches, the attackers modified the authoritative Name Server (NS) records directly within the root ccTLD zone files.
* DNSSEC Disablement: In zones where DNS Security Extensions (DNSSEC) were deployed, the attackers revoked or overwrote Delegation Signer (DS) records, disabling cryptographic validation across global recursive DNS resolvers.
2. Weaponizing ACME DNS-01 Challenges to Mint Rogue TLS Certificates
Modern certificate authorities (such as Let's Encrypt, ZeroSSL, and DigiCert) issue automated TLS certificates using the ACME protocol:
* The DNS-01 Challenge Mechanism: To prove control over a domain name, an applicant publishes a random cryptographic token in a DNS TXT record (_acme-challenge.domain.com).
* Automated Certificate Issuance: Because the threat actors controlled the authoritative registry name servers, they responded to the certificate authority's validation queries with the correct challenge token.
* Valid Public Certificates Minted: Within minutes, the attackers obtained cryptographically valid, trusted X.509 HTTPS certificates for google.com.gh, mail.google.com.gh, and related localized government service domains, signed by major public Certificate Authorities.
3. Transparent Adversary-in-the-Middle (AiTM) Interception
With rogue DNS records and authentic TLS certificates in hand, the attackers executed transparent traffic diversion:
* Traffic Redirection: Global internet traffic intended for the affected Google services was routed to attacker-controlled reverse proxy clusters hosted on bulletproof server networks.
* Zero Browser Warnings: Because the attackers presented authentic TLS certificates matching the requested domain name, end-users' web browsers (Chrome, Safari, Firefox) displayed secure padlock icons without certificate error warnings.
* Credential and Session Decryption: The proxy decrypted incoming HTTPS traffic, harvesting Google account credentials, session cookies, and private communications before re-encrypting and forwarding the traffic to Google's legitimate servers.
Breach Parameter
Forensic Finding
Impacted Infrastructure
National ccTLD Registries for Ghana (.gh), Sierra Leone (.sl), American Samoa (.as)
High-Profile Target
Localized Google Search, Gmail, and regional government portals
Attack Technique
Authoritative Name Server redirection & DNSSEC delegation tampering
Cryptographic Vector
ACME DNS-01 challenge completion to mint valid public TLS certificates
Operational Impact
Decryption of HTTPS traffic; harvesting of search queries and session tokens
Investigative Disclosures
Google Threat Intelligence & SecurityWeek Global Network
The Systemic Fragility of the Hierarchical Internet Trust Model
The ccTLD hijacking incident highlights a fundamental structural vulnerability in internet governance:
* The Sovereign Registry Blindspot: While global tech giants invest heavily in securing their proprietary networks, their country-code domains remain tethered to the cybersecurity hygiene of foreign national registries.
* Automated CA Validation Risks: Automated certificate issuance systems operate on the assumption that authoritative DNS responses represent legitimate ownership, allowing registry compromises to instantly translate into cryptographic certificate issuance.
Recommendations and Mitigations
Enterprise organizations, national registries, and cybersecurity architects should implement the following defenses:
1. Deploy CAA (Certificate Authority Authorization) Records:
* Configure DNS CAA records restricting which specific Certificate Authorities are permitted to issue certificates for corporate domains, blocking rogue issuance from unauthorized CAs.
2. Monitor Certificate Transparency (CT) Logs in Real Time:
* Implement automated Certificate Transparency log monitoring (via tools like Certstream or Cloudflare) to receive instantaneous alerts whenever a public TLS certificate is issued for any organizational domain.
3. Mandate Multi-Party Verification on Registry Updates:
* National TLD registries must enforce multi-factor authentication, registry locks (EPP status codes serverUpdateProhibited), and manual out-of-band approvals before modifying authoritative NS records for high-profile domains.
4. Deploy Enterprise Encrypted DNS (DoH/DoT) with DNSSEC Enforcement:
* Enforce DNS over HTTPS (DoH) across enterprise endpoints with strict DNSSEC validation, rejecting unvalidated records when delegation signatures are stripped.