Hackers hijack Google domains after breaching ccTLD registries

Thu, 08 Oct 2026 17:51:36 +0000

Engineer — Plan: Registry-level DNS tampering enabled unauthorized certificate issuance — audit DNS records and check Certificate Transparency logs (crt.sh) for any unexpected cert issuances on domains your org owns, especially in .gh/.as/.sl ccTLDs; confirm DNSSEC is enabled where possible.
SOC/IR — Act: Active DNS hijacking via compromised registry operators is in progress — query CT logs for unexpected certificate issuances against your org’s domains, and hunt for anomalous DNS record changes since early October 2026 across your monitored domain portfolio.
Leader — Plan: Breach of ccTLD registry operators affecting multiple country-code TLDs warrants an inventory check — confirm whether your organization holds domains in .gh, .as, or .sl ccTLDs and request a DNS record integrity attestation from your registrar or domain management vendor.

Certificate-Misissuance on CuraSec