Loading story…
Google reported that it detected and blocked an attempted man-in-the-middle campaign after attackers used a fraudulent certificate for google.com, allowing interception of users' connections to Google services. The certificate was traced to Dutch certificate authority DigiNotar, whose systems had been compromised, and the attack reportedly affected hundreds of thousands of users, primarily in Iran. Google said Chrome's built-in certificate checks helped expose the issue after a user encountered Gmail certificate warnings.
Subsequent reporting found that attackers exploited unpatched DigiNotar systems and generated at least 531 rogue certificates, turning the breach into a major failure of the internet's certificate trust model. The Dutch government assumed control of DigiNotar, browser vendors revoked trust in its certificates, and the company ultimately collapsed. The incident became a catalyst for stronger certificate authority controls and broader adoption of defenses including certificate pinning and Certificate Transparency.
See attribution, scope, and your downstream exposure.
11 events from the most recent confirmed update back to the earliest known activity.
Google publicly said it had detected and rejected a fraudulent certificate for Google services and attributed the issue to a compromise of DigiNotar. Google said about 298,140 affected IPs had been seen, roughly 95 percent of them in Iran.
An Iranian user using the alias alibo reported that Gmail was inaccessible from Iran unless a VPN was used, helping expose the fraudulent certificate activity.
In August 2011, thousands of Iranian users were redirected to fraudulent Google-looking sites using a rogue DigiNotar google.com certificate in an apparent effort to access Gmail communications.
DigiNotar discovered that some signed certificates were missing from its logs, then revoked the discovered rogue certificates and began an internal investigation.
The intruder issued the first fraudulent certificate via DigiNotar, marking the start of rogue certificate generation from the compromised CA.
By the end of July 2011, DigiNotar incorrectly believed it had contained the compromise, even though attackers continued to abuse rogue certificates.
Attackers exploited unpatched software on DigiNotar web servers to obtain an initial foothold in the certificate authority's environment.
By the end of the summer of 2011, the attacker had issued 531 rogue certificates for domains including google.com, microsoft.com, aol.com, cia.gov, and mossad.gov.il.
Within a month of the public disclosure, the Dutch government took over DigiNotar and commissioned Fox-IT to investigate the breach.
Following the fallout from the compromise and loss of trust, DigiNotar eventually declared bankruptcy and ceased operations.
After the compromise became public, browser vendors moved to revoke trust in DigiNotar certificates, including Mozilla shipping changes to block affected certificates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DigiNotar, a Dutch certificate authority, was compromised and used to issue at least 531 fraudulent SSL certificates for 344 domains, including `google.com`, enabling spoofing and man-in-the-middle attacks against supposedly secure services. Reporting indicated the fake Google certificate was likely used to intercept Gmail traffic from users in Iran, potentially exposing roughly 300,000 accounts and putting dissidents at risk. The breach was publicly linked to the actor who had claimed responsibility for the earlier Comodo certificate fraud, and it intensified criticism of the certificate authority trust model as incapable of resisting nation-state abuse. The fallout spread quickly across browsers, operating systems, and government services. Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates, while Microsoft issued advisory `2607712` and updates including `KB2607712` and `KB2616676` to place DigiNotar certificates in the Windows Untrusted Certificate Store; Safari users were reported to remain exposed for a time. In the Netherlands, the government took over DigiNotar’s operations after investigators found severe security failures, warned that it could not guarantee the safety of its own websites, and shifted trust for public-sector certificates as DigiNotar’s business collapsed into bankruptcy.
Jun 29, 2026
DigiCert disclosed a breach in which a threat actor socially engineered its support team with a malicious ZIP file disguised as a customer screenshot, compromising two analyst workstations and gaining access to initialization codes for previously approved but undelivered EV code-signing certificate orders. The attacker used that access to obtain legitimate trusted code-signing certificates, and DigiCert revoked 60 certificates in response, including 27 directly linked to the intrusion. Reporting indicates 11 of those certificates were already used in the wild to sign **Zhong Stealer** malware, while a misconfigured CrowdStrike EDR agent on one compromised machine helped the attacker remain undetected for nearly two weeks. The incident unfolded alongside a separate trust-related disruption affecting DigiCert certificates on Windows systems: a faulty Microsoft Defender signature update released around April 30 falsely detected the legitimate **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4** certificates as `Trojan:Win32/Cerdigent.A!dha`. On affected hosts, Defender quarantined registry entries from the Windows trust store, raising the risk of SSL/TLS validation failures, broken code-signing verification, browser warnings, and enterprise application outages. Microsoft acknowledged the false positives and issued corrected definitions, with version `.430` cited as restoring the removed certificates automatically, while DigiCert tightened controls by enforcing MFA on administrative workflows, restricting access to initialization codes, limiting attachment types in support channels, and improving logging.
Jul 20, 2026
CISA and Mandiant reported a global **DNS infrastructure hijacking** campaign in which attackers used compromised DNS-management credentials to alter victim **A**, **MX**, and **NS** records, redirecting web and email traffic to attacker-controlled systems. The activity affected dozens of domains linked to government, telecommunications, and internet infrastructure organizations across the Middle East and North Africa, Europe, and North America, enabling interception, manipulation, and man-in-the-middle access to sensitive communications. Investigators said the campaign operated at scale over an extended period and in some cases allowed the attackers to obtain valid **TLS certificates** for victim domains, letting them decrypt redirected traffic without triggering browser warnings. Mandiant said the infrastructure and access patterns suggest a likely nexus to Iran and alignment with Iranian government interests, while noting the activity may involve multiple operational clusters. CISA urged organizations to reset DNS account passwords, enable **multifactor authentication**, audit public DNS records, and revoke any fraudulent certificates tied to affected domains.
Aug 15, 2026