Plan
active
Attackers Hijack Three ccTLD Registries to Forge Google HTTPS Certs
- Engineer — Plan: Audit Certificate Transparency logs (crt.sh) for unauthorized certificates issued against any domains your organization owns in .gh, .sl, or .as TLDs; if hits found, treat as active compromise and revoke/reissue. Broader takeaway: review certificate pinning posture for critical services.
- SOC/IR — Learn: Registry-level compromise enabling HTTPS certificate fraud is a novel MITM vector worth understanding, but the summary provides no IOCs, TTPs, or detection signatures to act on today.
- Leader — Plan: Determine whether your organization operates services or depends on vendors using .gh, .sl, or .as domains; if so, commission a CT log audit this quarter and confirm no traffic was intercepted. No immediate board action needed unless exposure is confirmed.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.