Act
active
Hackers hijack Google domains after breaching ccTLD registries
- Engineer — Plan: Registry-level DNS tampering enabled unauthorized certificate issuance — audit DNS records and check Certificate Transparency logs (crt.sh) for any unexpected cert issuances on domains your org owns, especially in .gh/.as/.sl ccTLDs; confirm DNSSEC is enabled where possible.
- SOC/IR — Act: Active DNS hijacking via compromised registry operators is in progress — query CT logs for unexpected certificate issuances against your org’s domains, and hunt for anomalous DNS record changes since early October 2026 across your monitored domain portfolio.
- Leader — Plan: Breach of ccTLD registry operators affecting multiple country-code TLDs warrants an inventory check — confirm whether your organization holds domains in .gh, .as, or .sl ccTLDs and request a DNS record integrity attestation from your registrar or domain management vendor.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.