Attackers Hijack Three ccTLDs to Obtain Google Certificates
The incidents affected the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces, according to a post published by Google's Chrome Secure Web and Networking Team on October 6.
In this incident, Huntress researchers were able to piece together multiple sources archeology-style—including Registry data, Akira log files, and more—to map out what happened during some parts of the attack.
Upon investigating the breach, ASOS discovered that the attacker had gained access to an employee account “by impersonating a trusted contact to obtain log in credentials.” These credentials were then used to “access information on certain third-party platforms used by ASOS.” In a statement sent to the London Stock Exchange , published on October 6, ASOS said they are investigating third-party platforms which were used to communicate with customers.
While CAA cannot prevent certificate issuance during an active DNS hijack, the company said restoring a restrictive policy afterward stops attackers from reusing cached domain-control validation checks to obtain new certificates.
Google proactively blocked those certificates in Chrome and said it contacted affected organizations where possible.
In the Telegram channel which was linked to in the push notification claiming the hack, the attacker, using the name ‘Xuanyewen’ and ‘Xuanye group,’ said the incident only involves “customer information.” They claimed it “is safe on our server and will not be touched for a designated period.” According to the BBC, a sample of the stolen data it was sent by the threat actor contained more information than the "basic contact details" ASOS had previously said may have been compromised.
Google said the incidents did not involve a compromise of its own systems and that it had no reason to believe the certificate authorities (CAs) that issued the affected certificates had acted improperly.
For example, even without a recorded ransomware command line, the timeline provides strong evidence of execution: Shellbags show the threat actor accessed the folder, an Akira log file indicates the ransomware targeted it, and a concurrent PowerShell command removed volume shadow copies, a common Akira action.
An investigation into the impacted endpoint revealed that the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.
In this case, Huntress analysts saw a command line in the PowerShell Event Logs that indicated that the ransomware had been launched: powershell.exe -Command Get-WmiObject Win32_Shadowcopy , Remove-WmiObject Interestingly, this command line corresponded with the creation of an Akira log file, indicating that the ransomware had been launched against the Shares folder.
Those same artifacts showed that this sequence of events occurred three more times, with the threat actor launching the ransomware, PowerShell artifacts associated with the launch being created alongside the Akira log file, and then the threat actor accessing the target folder via Windows Explorer to ensure that the encryption was successful.
What happened
In this incident, Huntress researchers were able to piece together multiple sources archeology-style—including Registry data, Akira log files, and more—to map out what happened during some parts of the attack.
Upon investigating the breach, ASOS discovered that the attacker had gained access to an employee account “by impersonating a trusted contact to obtain log in credentials.” These credentials were then used to “access information on certain third-party platforms used by ASOS.” In a statement sent to the London Stock Exchange , published on October 6, ASOS said they are investigating third-party platforms which were used to communicate with customers.
What changed
While CAA cannot prevent certificate issuance during an active DNS hijack, the company said restoring a restrictive policy afterward stops attackers from reusing cached domain-control validation checks to obtain new certificates.
Google proactively blocked those certificates in Chrome and said it contacted affected organizations where possible.
Who is affected
In the Telegram channel which was linked to in the push notification claiming the hack, the attacker, using the name ‘Xuanyewen’ and ‘Xuanye group,’ said the incident only involves “customer information.” They claimed it “is safe on our server and will not be touched for a designated period.” According to the BBC, a sample of the stolen data it was sent by the threat actor contained more information than the "basic contact details" ASOS had previously said may have been compromised.
Google said the incidents did not involve a compromise of its own systems and that it had no reason to believe the certificate authorities (CAs) that issued the affected certificates had acted improperly.
Why it matters
For example, even without a recorded ransomware command line, the timeline provides strong evidence of execution: Shellbags show the threat actor accessed the folder, an Akira log file indicates the ransomware targeted it, and a concurrent PowerShell command removed volume shadow copies, a common Akira action.
An investigation into the impacted endpoint revealed that the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware.
Technical details
In this case, Huntress analysts saw a command line in the PowerShell Event Logs that indicated that the ransomware had been launched: powershell.exe -Command Get-WmiObject Win32_Shadowcopy , Remove-WmiObject Interestingly, this command line corresponded with the creation of an Akira log file, indicating that the ransomware had been launched against the Shares folder.
Those same artifacts showed that this sequence of events occurred three more times, with the threat actor launching the ransomware, PowerShell artifacts associated with the launch being created alongside the Akira log file, and then the threat actor accessing the target folder via Windows Explorer to ensure that the encryption was successful.
However, Pieter Arntz, senior malware intelligence researcher at Malwarebytes, suggested that an agentic marketing platform used by ASOS, known as Simon AI, may be indirectly linked to the incident because it is built on Snowflake Cortex AI .
Response
Chrome responded by blocking the unauthorized certificates for Google properties through CRLSets, the mechanism Chrome uses to quickly block certificates in emergencies.
In September, the Huntress agent was deployed on an organization that had been hit by an Akira ransomware attack.
What security teams should do
Google said browser-side blocking should not be relied on because its analysis may not have identified every affected domain and Chrome's interventions do not reliably protect non-Chrome users.
Google recommended that domain owners continuously monitor CT logs across their entire domain portfolios, including parked and regional ccTLD properties.
Attribution
Infosecurity Magazine: The incidents affected the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) namespaces, according to a post published by Google's Chrome Secure Web and Networking Team on October 6.
Infosecurity Magazine: In the email to customers on October 8, shared with Infosecurity, ASOS also confirmed that payment information was not compromised and that the incident has not affected operations.
Infosecurity Magazine: In a report published on October 6, the coalition called for a binding operational directive (BOD), arguing that no directive sets minimum practices for federal OT and that CISA lacks visibility into the risks.
Infosecurity Magazine: In research published on October 7, Barracuda said it analyzed a campaign that combined traditional social engineering, such as password-protected attachments, with prompt injection concealed in the same message.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.