The impacted ccTLDs are:

• Ghana
• American Samoa
• Sierra Leone

According to the reporting, the intruders gained access by breaching third-party operators rather than the registries themselves, then altered authoritative DNS records to redirect or take control of the affected domains. The unauthorized certificate issuance for Google domains is a notable escalation, since valid HTTPS certificates can make hijacked domains appear legitimate to visitors and can undermine trust assumptions built into web traffic.

Details on the exact domains affected, the timeline of the compromise, and any remediation guidance have not been fully outlined in the available reporting.

Source: BleepingComputer

If your organization depends on domains under these ccTLDs, have you reviewed your DNS records and certificate logs for signs of tampering?