Hackers Hijack Google Domains via Compromised ccTLD Registries

How Attackers Exploited Registry Weaknesses

In October 2026, cybercriminals breached country-code top-level domain registries for Ghana, American Samoa, and Sierra Leone, enabling them to hijack several Google domains and obtain unauthorized HTTPS certificates. The attacks targeted third-party operators managing these ccTLDs, allowing threat actors to alter authoritative DNS records and redirect traffic intended for legitimate Google services. This incident highlights vulnerabilities in the domain name system’s hierarchical trust model, particularly where regional registries rely on external partners with varying security standards.

Investigators confirmed that hackers gained access to the backend systems of ccTLD administrators through compromised credentials or unpatched software. Once inside, they modified NS (name server) records for specific Google-owned domains, effectively seizing control over DNS resolution. With domain control established, the attackers requested and received valid TLS certificates from certificate authorities, which trusted the altered DNS validation process. This allowed them to impersonate Google domains with encrypted connections that appeared legitimate to users and browsers. The manipulation went undetected for several days due to the absence of real-time monitoring alerts in some registry systems.

Why Google Domains Were Targeted

Threat actors likely selected high-profile domains like those belonging to Google to maximize the potential impact of man-in-the-middle attacks, phishing campaigns, or malware distribution. By hijacking trusted domains, attackers could intercept user communications, steal login credentials, or deploy malicious updates under the guise of legitimate services. The choice of Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl) ccTLDs suggests attackers exploited perceived gaps in security oversight within smaller or less-resourced registry operators. These regions may lack the resources to implement advanced threat detection or enforce strict access controls compared to larger TLD managers.

Following the breach, affected ccTLD managers have reset administrative passwords, implemented multi-factor authentication, and begun auditing access logs for suspicious activity. Industry groups including ICANN and regional internet registries are urging all domain operators to adopt DNSSEC and certificate transparency logs to prevent similar exploits. Google has revoked the fraudulent certificates and notified users through its security advisories, though no evidence suggests end-user data was compromised during the window of exposure. Experts warn that without systemic improvements in registry security, such incidents could recur across other ccTLDs.

What Measures Are Registries Taking Now?

How did hackers obtain valid HTTPS certificates for hijacked domains? By altering DNS records to pass domain validation checks, attackers tricked certificate authorities into issuing trusted TLS certificates for domains they did not legitimately control.

Frequently Asked Questions

Were Google’s internal systems breached during this incident? No, the attack occurred at the registry level; Google’s own servers and infrastructure remained secure and were not directly compromised.

What steps can domain owners take to prevent similar hijacks? Enable DNSSEC, monitor certificate transparency logs for unauthorized issuance, and use registry locks where available to prevent unauthorized changes to domain records.