InfoSecBulletin Cybersecurity for mankind
Research from VulnCheck reveals that a highly skilled threat actor has been running a private Out-of-band Application Security Testing (OAST) service on Google Cloud infrastructure, executing an extensive exploit campaign aimed at over 200 CVEs.
Private OAST Domain Raises Red Flags:
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Security experts at VulnCheck noticed strange behavior linked to detectors-testing.com, an unknown OAST domain not connected to any known public OAST provider.
Unlike typical attackers who rely on public services like oast. Fun, past, pro, or interact. This threat actor operates their own private infrastructure.
The investigation found around 1,400 exploit attempts related to over 200 different CVEs. The attacks mainly employed modified Nuclei templates to check for vulnerabilities in target networks.
Malicious activity was aimed at Canary Systems in Brazil, showing a specific focus on this region. Although VulnCheck has canary sensors worldwide, the attacker only targeted Brazilian systems from October to November 2025.
Attacker-controlled OAST subdomains, like i-sh.detectors-testing.com, receive HTTP callbacks from compromised systems to confirm successful exploitation.
One documented example involved an attempt to exploit CVE-2025-4428, a remote code execution vulnerability in Ivanti Endpoint Manager Mobile.
The entire operation runs through US-based Google Cloud infrastructure across multiple IP addresses.
Using a main cloud provider helps attackers because defenders rarely block traffic from these services, allowing malicious activity to mix with normal network traffic.
VulnCheck identified six scanner IPs and one dedicated OAST host, all operating from Google Cloud. The OAST server at 34.136.22.26 has been running Interactsh services across multiple ports for at least a year, since November 2024.
The attacker uses custom payloads in addition to standard Nuclei templates to show their skills. Researchers found a modified TouchFile.class Java exploit file on the attacker’s server.
This file extends the standard Fastjson 1.2.47 exploitation method with additional command execution and HTTP callback functionality.
The attacker uses old Nuclei templates that have been removed from official repositories, indicating they keep a modified scanning toolkit instead of just using public tools.
Indicators of Compromise:
Organizations should monitor for connections to detectors-testing.com and its subdomains.
The following Google Cloud IP addresses have been associated with this campaign: 34.172.194.72, 35.194.0.176, 34.133.225.171, 34.68.101.3, 34.42.21.27, 34.16.7.161, and 34.136.22.26.
Security teams must patch all internet-facing applications against known vulnerabilities, especially the 200+ actively exploited CVEs.
Network monitoring for unusual OAST callbacks and regular vulnerability assessments are crucial defenses against ongoing scanning attacks.
