Sri Lanka LK Domain Registry hijack (Google.lk)

On the morning of 6 February 2021, just after Sri Lanka's independence-day weekend, visitors to Google.lk found themselves redirected to a political propaganda page. The hijack did not stop at Google: around ten high-profile .lk domains, including Oracle.lk, were pointed to attacker-controlled content by tampering at the country's national domain registry.

What happened

The LK Domain Registry is the authority that administers Sri Lanka's .lk top-level domain. Attackers altered the DNS records for a cluster of major domains so that traffic resolved to a new IP address serving their message — a registry-level redirection that affected even domains the registry did not directly control, such as Google.lk.

The redirected page surfaced contemporary Sri Lankan political grievances, including the plight of plantation workers and the Tamil community, Tamil political prisoners, and the "forced cremations" of Muslim and minority COVID-19 victims — framing the operation as hacktivism rather than financially-motivated crime.

A subsequent investigation uncovered the likely root cause: administrator credentials for the registry had been circulating on the dark web since 2012 and reportedly remained valid until September 2020, giving the attackers a straightforward path in.

Impact

• Roughly ten major .lk domains were redirected, most prominently Google.lk and Oracle.lk.
• The registry team detected the unauthorised changes and reverted them, restoring normal resolution within about 90 minutes.
• No data theft was reported; the damage was reputational and symbolic — demonstrating that a single nation's entire TLD could be subverted from one weak set of credentials.

Response and aftermath

The LK Domain Registry rolled back the malicious DNS entries, and Sri Lanka CERT and the Information Technology Society of Sri Lanka (ITSSL) opened investigations. The exposed-credential finding prompted urgent calls to enforce credential hygiene and multi-factor authentication on critical registry infrastructure. A further wave of defacements in May 2021, claimed by a "Tamil Eelam Cyber Force," targeted government ministries and embassy websites, underscoring a sustained hacktivist campaign against Sri Lankan digital assets.

Why it matters

Hijacking a national domain registry is among the highest-leverage attacks possible: control the registry and you control how an entire country's most-visited sites resolve. That this was achieved through decade-old leaked credentials — not a novel exploit — made it a stark lesson in the cost of neglected credential management at the most critical layer of internet infrastructure.