Attackers reportedly compromised country-code registry infrastructure for .gh, .sl, and .as and obtained certificates for Google domains. Let’s Encrypt staff said certificates for Google and YouTube were issued and later revoked.
The incident highlights a trust-chain risk beyond a victim’s own application stack: a compromise affecting registry or DNS controls can enable unauthorized certificate issuance. Security teams should monitor certificate-transparency logs for their domains, ensure certificate-issuance controls are configured where supported, and maintain tested procedures for revocation and certificate replacement.
Organizations should also confirm ownership and access controls for registrar, DNS, and certificate-management accounts. High-value domains warrant alerting for DNS changes, new certificates, and unexpected validation events.
Source: The Hacker News