Executive Summary
In late 2024, threat actors successfully compromised third-party operators managing country-code top-level domains (ccTLDs) for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl), allowing them to hijack multiple Google domains and obtain unauthorized HTTPS certificates. The attackers modified authoritative DNS records to redirect legitimate Google traffic to attacker-controlled infrastructure, potentially enabling man-in-the-middle attacks, credential harvesting, and service disruption. This supply-chain attack highlights the critical vulnerability of DNS infrastructure and the cascading impact when trusted domain registries are compromised.
This incident underscores the growing threat to DNS infrastructure as nation-state and sophisticated threat actors increasingly target supply-chain components to compromise high-value targets like Google's services and domains.
Why This Matters Now
DNS hijacking attacks targeting ccTLD registries represent a critical escalation in supply-chain threats, as compromising domain infrastructure can bypass traditional security controls and impact millions of users relying on legitimate services.
Attack Path Analysis
Attackers compromised third-party DNS operators managing ccTLD registries for Ghana, American Samoa, and Sierra Leone, then escalated privileges to modify authoritative DNS records for Google domains. Using their DNS control, they performed domain hijacking to redirect legitimate Google traffic and obtained unauthorized HTTPS certificates. The compromised domains enabled command and control infrastructure while potentially intercepting sensitive user data through DNS redirection. The attack created supply chain impact by undermining trust in domain infrastructure and enabling potential credential harvesting from redirected traffic.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers breached third-party operators managing ccTLD registries for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl)
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Acquire Infrastructure: Web Services
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Stage Capabilities: Install Digital Certificate
Data Manipulation: Stored Data Manipulation
Acquire Infrastructure: Domains
Remote System Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Third-Party Service Provider Security Policy
Control ID: 500.11
DORA – ICT Third-Party Risk Management
Control ID: Article 28
CISA Zero Trust Maturity Model 2.0 – Data Asset Management
Control ID: DA.AM
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
ISO 27001:2022 – Information Security Policy for Supplier Relationships
Control ID: A.15.1.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Internet
Domain hijacking compromises web infrastructure integrity, enabling supply-chain attacks through unauthorized certificates affecting user trust and traffic redirection capabilities.
Information Technology/IT
DNS registry breaches expose critical infrastructure vulnerabilities requiring enhanced egress security, zero trust segmentation, and threat detection for ccTLD operators.
Financial Services
Certificate spoofing enables phishing attacks targeting banking domains, requiring multicloud visibility and encrypted traffic monitoring to prevent credential harvesting.
Government Administration
ccTLD compromise threatens national digital sovereignty and citizen services, demanding immediate policy enforcement and anomaly detection for DNS infrastructure protection.
Sources
- Hackers hijack Google domains after breaching ccTLD registrieshttps://www.bleepingcomputer.com/news/security/hackers-hijack-google-domains-after-breaching-cctld-registries/Verified
- CISA Alert: DNS Infrastructure Hijacking Campaignhttps://www.cisa.gov/news-events/alerts/2019/01/10/dns-infrastructure-hijacking-campaignVerified
- Certificate Transparency Monitoring for Unauthorized Certificateshttps://certificate.transparency.dev/Verified
- NIST Special Publication 1800-25: Data Integrity - Detecting and Responding to Ransomware and Other Destructive Eventshttps://www.nist.gov/publications/data-integrity-detecting-and-responding-ransomware-and-other-destructive-eventsVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have constrained the DNS hijacking attack's lateral movement and reduced blast radius through network segmentation and controlled egress policies. While external domain compromise cannot be prevented, CNSF would likely limit internal infrastructure reach and outbound certificate validation paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Cloud native security fabric would likely reduce the attack surface by providing visibility into DNS infrastructure communications and potentially constraining initial reconnaissance activities against cloud-hosted DNS management systems.
Control: Zero Trust Segmentation
Mitigation: Zero trust segmentation would likely constrain privilege escalation by limiting administrative access scope and reducing the blast radius of compromised credentials within DNS management infrastructure.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain lateral movement between DNS infrastructure systems and reduce the attacker's ability to pivot across multiple ccTLD management platforms.
Control: Multicloud Visibility & Control
Mitigation: Multi-cloud visibility could likely detect unauthorized DNS record modifications and certificate requests, potentially constraining the attacker's ability to establish persistent command and control infrastructure.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely constrain data exfiltration paths and limit the attacker's ability to redirect hijacked traffic to external collection infrastructure.
While domain hijacking impact cannot be eliminated, CNSF constraints would likely reduce the scope of affected infrastructure and limit the attacker's ability to maintain persistent access across multiple cloud environments.
Impact at a Glance
Affected Business Functions
- Domain Name Resolution Services
- Certificate Authority Operations
- DNS Security Infrastructure
- Trust and Authentication Services
Estimated downtime: 2 days
Estimated loss: N/A
Unauthorized HTTPS certificates were issued for Google domains, potentially enabling man-in-the-middle attacks and impersonation of legitimate Google services. DNS records for multiple ccTLD domains were compromised, affecting domain resolution integrity for Ghana, American Samoa, and Sierra Leone top-level domains.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies to limit DNS infrastructure access and prevent lateral movement between registry systems
- • Deploy Egress Security & Policy Enforcement to monitor and control outbound DNS queries, certificate requests, and unauthorized external communications
- • Enable Multicloud Visibility & Control to detect anomalous DNS modifications, suspicious certificate requests, and unauthorized domain resolution changes
- • Establish Encrypted Traffic (HPE) protection for all DNS management communications and certificate authority interactions to prevent interception
- • Activate Threat Detection & Anomaly Response capabilities to baseline DNS query patterns and alert on unusual domain resolution behavior or certificate provisioning activities
