Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Google reported that attackers compromised authoritative DNS for three ccTLDs (.gh, .sl, .as) allowing issuance of unauthorized domain-validated HTTPS certificates for Google and YouTube names; CT logs show 12 certificates issued between Sep 22–27 and CAs (primarily Let's Encrypt) revoked them after Google and Chrome blocked the certificates. The report lists the certificate issuance/revocation timeline, SHA-256 fingerprints for all 12 certificates, notes that Google systems were not breached, and recommends domain owners monitor CT logs, publish strict CAA records, and report unsolicited certificates to CAs.