InfoSecBulletin Cybersecurity for mankind
Research from VulnCheck reveals that a highly skilled threat actor has been running a private Out-of-band Application Security Testing (OAST) service on Google Cloud infrastructure, executing an extensive exploit campaign aimed at over 200 CVEs.
Private OAST Domain Raises Red Flags:
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Security experts at VulnCheck noticed strange behavior linked to detectors-testing.com, an unknown OAST domain not connected to any known public OAST provider.
Unlike typical attackers who rely on public services like oast. Fun, past, pro, or interact. This threat actor operates their own private infrastructure.
The investigation found around 1,400 exploit attempts related to over 200 different CVEs. The attacks mainly employed modified Nuclei templates to check for vulnerabilities in target networks.
Malicious activity was aimed at Canary Systems in Brazil, showing a specific focus on this region. Although VulnCheck has canary sensors worldwide, the attacker only targeted Brazilian systems from October to November 2025.
Attacker-controlled OAST subdomains, like i-sh.detectors-testing.com, receive HTTP callbacks from compromised systems to confirm successful exploitation.
One documented example involved an attempt to exploit CVE-2025-4428, a remote code execution vulnerability in Ivanti Endpoint Manager Mobile.
The entire operation runs through US-based Google Cloud infrastructure across multiple IP addresses.
Using a main cloud provider helps attackers because defenders rarely block traffic from these services, allowing malicious activity to mix with normal network traffic.
VulnCheck identified six scanner IPs and one dedicated OAST host, all operating from Google Cloud. The OAST server at 34.136.22.26 has been running Interactsh services across multiple ports for at least a year, since November 2024.
The attacker uses custom payloads in addition to standard Nuclei templates to show their skills. Researchers found a modified TouchFile.class Java exploit file on the attacker’s server.
This file extends the standard Fastjson 1.2.47 exploitation method with additional command execution and HTTP callback functionality.
The attacker uses old Nuclei templates that have been removed from official repositories, indicating they keep a modified scanning toolkit instead of just using public tools.
Indicators of Compromise:
Organizations should monitor for connections to detectors-testing.com and its subdomains.
The following Google Cloud IP addresses have been associated with this campaign: 34.172.194.72, 35.194.0.176, 34.133.225.171, 34.68.101.3, 34.42.21.27, 34.16.7.161, and 34.136.22.26.
Security teams must patch all internet-facing applications against known vulnerabilities, especially the 200+ actively exploited CVEs.
Network monitoring for unusual OAST callbacks and regular vulnerability assessments are crucial defenses against ongoing scanning attacks.
