InfoSecBulletin Cybersecurity for mankind
Research from VulnCheck reveals that a highly skilled threat actor has been running a private Out-of-band Application Security Testing (OAST) service on Google Cloud infrastructure, executing an extensive exploit campaign aimed at over 200 CVEs.
Private OAST Domain Raises Red Flags:
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Security experts at VulnCheck noticed strange behavior linked to detectors-testing.com, an unknown OAST domain not connected to any known public OAST provider.
Unlike typical attackers who rely on public services like oast. Fun, past, pro, or interact. This threat actor operates their own private infrastructure.
The investigation found around 1,400 exploit attempts related to over 200 different CVEs. The attacks mainly employed modified Nuclei templates to check for vulnerabilities in target networks.
Malicious activity was aimed at Canary Systems in Brazil, showing a specific focus on this region. Although VulnCheck has canary sensors worldwide, the attacker only targeted Brazilian systems from October to November 2025.
Attacker-controlled OAST subdomains, like i-sh.detectors-testing.com, receive HTTP callbacks from compromised systems to confirm successful exploitation.
One documented example involved an attempt to exploit CVE-2025-4428, a remote code execution vulnerability in Ivanti Endpoint Manager Mobile.
The entire operation runs through US-based Google Cloud infrastructure across multiple IP addresses.
Using a main cloud provider helps attackers because defenders rarely block traffic from these services, allowing malicious activity to mix with normal network traffic.
VulnCheck identified six scanner IPs and one dedicated OAST host, all operating from Google Cloud. The OAST server at 34.136.22.26 has been running Interactsh services across multiple ports for at least a year, since November 2024.
The attacker uses custom payloads in addition to standard Nuclei templates to show their skills. Researchers found a modified TouchFile.class Java exploit file on the attacker’s server.
This file extends the standard Fastjson 1.2.47 exploitation method with additional command execution and HTTP callback functionality.
The attacker uses old Nuclei templates that have been removed from official repositories, indicating they keep a modified scanning toolkit instead of just using public tools.
Indicators of Compromise:
Organizations should monitor for connections to detectors-testing.com and its subdomains.
The following Google Cloud IP addresses have been associated with this campaign: 34.172.194.72, 35.194.0.176, 34.133.225.171, 34.68.101.3, 34.42.21.27, 34.16.7.161, and 34.136.22.26.
Security teams must patch all internet-facing applications against known vulnerabilities, especially the 200+ actively exploited CVEs.
Network monitoring for unusual OAST callbacks and regular vulnerability assessments are crucial defenses against ongoing scanning attacks.
