Executive Summary
In October 2026, a significant supply-chain attack targeted the country-code top-level domain (ccTLD) registries for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). Attackers successfully compromised third-party operators of these registries, allowing them to modify authoritative DNS records. This access enabled the actors to pass Domain Control Validation (DCV) checks and obtain legitimate, unauthorized HTTPS certificates for several high-profile domains, including those belonging to Google and other global brands.
The attack allowed the threat actors to impersonate legitimate services and potentially intercept or serve arbitrary content to users visiting domains within these namespaces. While Google's internal systems were not breached, the scale of the impact affected any organization utilizing these specific regional extensions. Chrome responded by immediately blocking the affected certificates via CRLSets and coordinating with Certification Authorities (CAs) for revocation.
This incident highlights a critical vulnerability in the global DNS hierarchy where the security of a domain is entirely dependent on the integrity of its registry. Organizations operating in regional markets must recognize that traditional security perimeters do not protect against registry-level DNS manipulation.