Attackers compromised the .gh, .sl and .as country-code domains, altered authoritative DNS records and obtained unauthorized TLS certificates for several Google domains and other major services. Google blocked the identified certificates in Chrome and worked with issuers to revoke them.