Hackers hijack Google domains after breaching ccTLD registries

Hackers compromised third-party operators managing country-code top-level domain (ccTLD) registries for Ghana, American Samoa, and Sierra Leone. By gaining unauthorized access, attackers were able to modify authoritative DNS records for Google domains within these ccTLDs. The attackers also obtained unauthorized HTTPS certificates for several Google domains, enabling potential man-in-the-middle attacks. This attack highlights the risks associated with third-party ccTLD registry operators and DNS infrastructure security. The incident demonstrates how compromising upstream DNS authorities can have cascading effects on major platforms like Google. Unauthorized certificate issuance further compounds the severity by undermining trust in HTTPS for affected domains.