Attackers Hijack Three ccTLD Registries to Forge Google HTTPS Certs

Thu, 08 Oct 2026 17:51:36 +0000

Engineer — Plan: Audit Certificate Transparency logs (crt.sh) for unauthorized certificates issued against any domains your organization owns in .gh, .sl, or .as TLDs; if hits found, treat as active compromise and revoke/reissue. Broader takeaway: review certificate pinning posture for critical services.
SOC/IR — Learn: Registry-level compromise enabling HTTPS certificate fraud is a novel MITM vector worth understanding, but the summary provides no IOCs, TTPs, or detection signatures to act on today.
Leader — Plan: Determine whether your organization operates services or depends on vendors using .gh, .sl, or .as domains; if so, commission a CT log audit this quarter and confirm no traffic was intercepted. No immediate board action needed unless exposure is confirmed.

Cctld on CuraSec