Key takeaways

Between September 22 and 27, 2026, attackers hijacked the .gh, .sl, and .as country-code TLD registries and obtained 12 publicly trusted TLS certificates for Google and YouTube domains without compromising Google or the issuing certificate authorities.

By modifying authoritative DNS records, the attackers passed domain-validation checks. Control of DNS became control of certificate issuance, which is a pattern that’s been seen before in the 2012 PKNIC breach and the Sea Turtle campaign . Organizations inherit risk from registries, registrars, and DNS providers that they do not control, especially across regional, acquired, and vanity domain portfolios.

Continuous monitoring of DNS delegation, Certificate Transparency (CT) logs, and Certification Authority Authorization (CAA) policies can surface the signals that this type of attack leaves behind.

Recovering from a DNS compromise requires investigating and revoking certificates issued during the affected period, not just restoring DNS…