Attackers Hijack ccTLD Registries to Obtain Google Certificates

Threat actors compromised the country-code top-level domain registries for .gh, .sl, and .as, successfully obtaining unauthorized HTTPS certificates for Google domains. Although Google’s internal infrastructure remained uncompromised, the registry-level attacks put users at risk of sophisticated machine-in-the-middle interception by enabling attackers to impersonate legitimate encrypted services.