Sierra Leone (Country): news timeline & CVEs

Attackers hijack country-code domains to impersonate Google and other services

Attackers hijacked .gh, .sl, and .as DNS to get certificates impersonating Google and others.

Google said attackers compromised infrastructure behind the .gh, .sl, and .as country-code domains and used DNS control to pass validation and obtain trusted HTTPS certificates for Google domains and other organizations. Google's own systems were not compromised and encryption was not broken, but valid certificates plus traffic redirection could impersonate legitimate services. Google blocked unauthorized certificates in Chrome, worked with certificate authorities to revoke them, and later blocked suspicious certificates for other organizations. It warned the review may have missed domains and that Chrome interventions do not reliably protect non-Chrome users.

Malwarebytes LabsOct 8, 15:53 UTC · 8h agoPhishing & fraud in the wild 10 sources

Attackers Hijack Three ccTLDs to Obtain Google Certificates

Attackers hijacked the .gh, .sl, and .as registries and obtained unauthorized certificates covering Google domains.

Google's Chrome team said attackers compromised the .gh, .sl, and .as country-code registries, changed authoritative DNS records, and obtained unauthorized HTTPS certificates for Google domains and other organizations. Google said its own systems were not compromised and it had no reason to believe the issuing certificate authorities acted improperly. Chrome blocked the rogue Google certificates through CRLSets, and Google worked with the CAs to revoke them after Certificate Transparency logs showed additional affected brands. Google urged owners to monitor CT logs and set restrictive CAA records with ACME account bindings, while noting CAA cannot stop issuance during an active DNS hijack.

Infosecurity Magazineupdated Oct 8, 15:53 UTC · 8h agofirst Oct 8, 14:30 UTC · 10h agoData breach in the wild 10 sources

Attackers Hijack .gh, .sl, and .as Domains to Obtain Unauthorized SSL Certificates

Attackers hijacked .gh, .sl, and .as DNS to obtain unauthorized TLS certificates for Google and other organizations.

Chrome's Secure Web and Networking team disclosed on October 6, 2026 that attackers compromised authoritative DNS for the Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) country-code domains. By changing DNS records, they passed certificate domain validation and obtained unauthorized HTTPS certificates for Google properties and later other organizations, without breaching Google itself. Google blocked the certificates in Chrome using CRLSets and worked with the issuing authorities to revoke them. The report does not name the attackers, list every affected domain, or say whether the certificates were used to intercept traffic.

GBHackersupdated Oct 8, 15:53 UTC · 8h agofirst Oct 8, 07:46 UTC · 16h agoData breach in the wild 10 sources1

Hackers hijack Google domains after breaching ccTLD registries

Attackers breached .gh, .sl, and .as operators, hijacked DNS, and obtained TLS certificates for Google and others.

Attackers breached third-party operators of the Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) ccTLD registries and changed authoritative DNS records. That control let them obtain valid HTTPS certificates and point affected domains, including several Google domains and other major brands, at attacker infrastructure. Google said its own systems were not compromised and that the issuing certificate authorities did not act improperly. Chrome blocked the unauthorized certificates through CRLSets, but Google warned the lists may be incomplete and do not protect non-Chrome users.

BleepingComputerupdated Oct 8, 15:53 UTC · 8h agofirst Oct 7, 20:50 UTC · 1d agoData breach in the wild 10 sources1

Attackers hijacked top-level domains, minted fake security certs for Google and other orgs

Attackers hijacked .gh, .sl, and .as domains and minted fraudulent certificates for Google.

Google said attackers hijacked the .gh, .sl, and .as country-code top-level domains, changed authoritative DNS records, and obtained unauthorized HTTPS certificates covering several Google domains and domains of other organizations. Google's systems were not compromised, and the company said the certificate authorities that issued the certificates did nothing wrong. Chrome blocked suspected counterfeit certificates for the affected ccTLDs, but Google warned that protection may not cover every domain or non-Chrome users. It recommended Certificate Transparency monitoring and restrictive CAA records so attackers cannot keep issuing certificates after DNS control is restored.

The Register · Securityupdated Oct 8, 15:53 UTC · 8h agofirst Oct 7, 19:38 UTC · 1d agoThreat actor in the wild 10 sources

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers hijacked the .gh, .sl, and .as registries and obtained later-revoked HTTPS certificates for Google and YouTube domains.

Google said on October 6 that attackers compromised the .gh, .sl, and .as country-code registries and obtained unauthorized HTTPS certificates for Google and YouTube names, without breaching Google's own systems. Certificate Transparency logs show 12 domain-validated certificates, 11 from Let's Encrypt and one from ZeroSSL, logged between September 22 and 27 for names including google.com.gh, google.sl, and google.as. Chrome blocked the Google certificates via CRLSets, the issuing certificate authorities revoked all 12, and Google said the same DNS hijacks appear to have hit other unnamed organizations. Google did not confirm the certificates were used to intercept traffic and did not name the attackers.

The Hacker Newsupdated Oct 8, 15:53 UTC · 8h agofirst Oct 7, 18:48 UTC · 1d agoData breach in the wild 10 sources

Hackers Hijack .gh, .sl and .as Registry to Obtain Unauthorized HTTPS Certificates

Attackers hijacked .gh, .sl, and .as registries to obtain unauthorized TLS certificates for Google and others.

Google disclosed that attackers compromised the .gh, .sl, and .as country-code registries for Ghana, Sierra Leone, and American Samoa. By changing authoritative DNS records, they passed domain-control validation and obtained unauthorized HTTPS certificates for Google and other organizations. Google said its systems were not breached and the issuing certificate authorities were not at fault. Chrome blocked identified certificates through CRLSets, Google arranged revocations, and it warned the review may not have found every affected domain.

Cyber Security Newsupdated Oct 8, 15:53 UTC · 8h agofirst Oct 7, 15:39 UTC · 1d agoData breach in the wild 10 sources

Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains

Attackers hijacked Ghana, Sierra Leone, and American Samoa domain registries and obtained HTTPS certificates for Google domains.

Google said attackers compromised the third-party operators of the .gh, .sl, and .as country-code registries, then changed authoritative DNS records. That access was used to obtain HTTPS certificates for several Google domains and domains run by other large organizations. Google said its own systems were not compromised and that the issuing certificate authorities did not act improperly. Chrome blocked the certificates through CRLSets, the CAs revoked them, and Google warned that other affected domains may remain unidentified.

Help Net Securityupdated Oct 8, 15:53 UTC · 8h agofirst Oct 7, 11:10 UTC · 1d agoData breach in the wild 10 sources2· 1 read

Chrome's Response to Recent ccTLD Registry Hijacks

Attackers hijacked .gh, .sl, and .as registries, issuing unauthorized certificates for Google and other brands.

Google said attackers compromised the .gh, .sl, and .as country-code domain registries and changed authoritative DNS records. The hijacks did not involve Google's own systems, but attackers obtained unauthorized HTTPS certificates for several Google domains and for other organizations. Chrome blocked the suspect certificates with CRLSets, and Google worked with issuing certificate authorities to revoke them. Google said the authorities were not at fault and advised domain owners to monitor Certificate Transparency logs and publish restrictive CAA records, including ACME account bindings.

Lobsters · securityupdated Oct 8, 15:53 UTC · 8h agofirst Oct 6, 18:00 UTC · 2d agoData breach in the wild 10 sources1

Sierra Leone

Timeline9 articles

Appears with