Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, threat actors compromised three country-code top-level domains (ccTLDs) - .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) - to obtain unauthorized HTTPS certificates for Google domains. The attackers exploited vulnerabilities in the domain registry infrastructure to issue legitimate SSL/TLS certificates that could be used to impersonate Google services in man-in-the-middle attacks. While Google's own systems remained secure, the incident exposed critical weaknesses in the global DNS and certificate authority ecosystem, potentially affecting millions of users who could be redirected to malicious sites appearing legitimate with valid encryption.

This incident highlights the growing sophistication of supply chain attacks targeting internet infrastructure. As threat actors increasingly focus on certificate authorities and DNS registries to bypass traditional security measures, organizations must implement stronger certificate transparency monitoring and adopt zero-trust architectures that verify identity beyond SSL certificates.

Why This Matters Now

Certificate authority compromises are escalating as attackers recognize that valid SSL certificates can bypass security controls and user awareness. With the rise of AI-powered phishing and automated certificate abuse, organizations need immediate visibility into certificate issuance and robust egress filtering to prevent credential harvesting and data exfiltration through seemingly legitimate encrypted channels.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers could conduct man-in-the-middle attacks, intercept encrypted traffic, and create convincing phishing sites that appear legitimate with valid HTTPS encryption, bypassing user security awareness and many automated security tools.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely have reduced the attack's blast radius by constraining lateral movement between compromised registry systems and limiting unauthorized certificate usage through network segmentation and controlled egress policies.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Zero Trust segmentation policies would likely have constrained the attackers' ability to move freely between registry infrastructure components and limited their access to critical certificate authority systems within the compromised environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware network controls would likely have limited the scope of privilege escalation by restricting access to certificate authority functions based on authenticated workload identities rather than broad network access permissions.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Microsegmentation controls would likely have constrained lateral movement between different registry networks and limited the attackers' ability to coordinate operations across multiple ccTLD infrastructure environments simultaneously.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Network visibility controls would likely have detected suspicious certificate usage patterns and anomalous traffic flows between compromised infrastructure and external command and control endpoints masquerading as legitimate Google services.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely have limited the attackers' ability to establish unauthorized data transmission channels and constrained the volume of intercepted data that could be exfiltrated from compromised registry environments.

Impact (Mitigations)

While user exposure to fraudulent certificates would likely remain, the constrained attacker movement and limited exfiltration capabilities would likely have reduced the overall scope of compromised user data and shortened the duration of malicious certificate deployment.

Impact at a Glance

Affected Business Functions

  • DNS Infrastructure Management
  • Certificate Authority Operations
  • Web Services Authentication
  • Domain Registry Management
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: N/A

Data Exposure

Unauthorized HTTPS certificates were issued for Google domains through compromised ccTLD registries for .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). This could enable attackers to impersonate legitimate Google services and conduct man-in-the-middle attacks against users accessing services under these domains.

Recommended Actions

  • • Implement Egress Security & Policy Enforcement to detect and block unauthorized certificate usage and suspicious outbound connections to prevent man-in-the-middle attacks
  • • Deploy Encrypted Traffic (HPE) capabilities with certificate pinning and validation to ensure data in transit protection even when rogue certificates are present
  • • Establish Multicloud Visibility & Control to monitor certificate issuance anomalies and detect suspicious automation targeting domain infrastructure
  • • Enable Zero Trust Segmentation with identity-based policies to limit the impact of compromised certificates through least privilege access controls
  • • Activate Threat Detection & Anomaly Response to baseline normal certificate behavior and alert on unauthorized certificate authority activities

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image