Research from VulnCheck reveals that a highly skilled threat actor has been running a private Out-of-band Application Security Testing (OAST) service on Google Cloud infrastructure, executing an extensive exploit campaign aimed at over 200 CVEs.
Private OAST Domain Raises Red Flags:
Security experts at VulnCheck noticed strange behavior linked to detectors-testing.com, an unknown OAST domain not connected to any known public OAST provider.
Unlike typical attackers who rely on public services like oast. Fun, past, pro, or interact. This threat actor operates their own private infrastructure.
The investigation found around 1,400 exploit attempts related to over 200 different CVEs. The attacks mainly employed modified Nuclei templates to check for vulnerabilities in target networks.
Malicious activity was aimed at Canary Systems in Brazil, showing a specific focus on this region. Although VulnCheck has canary sensors worldwide, the attacker only targeted Brazilian systems from October to November 2025.
Attacker-controlled OAST subdomains, like i-sh.detectors-testing.com, receive HTTP callbacks from compromised systems to confirm successful exploitation.
One documented example involved an attempt to exploit CVE-2025-4428, a remote code execution vulnerability in Ivanti Endpoint Manager Mobile.
The entire operation runs through US-based Google Cloud infrastructure across multiple IP addresses.
Using a main cloud provider helps attackers because defenders rarely block traffic from these services, allowing malicious activity to mix with normal network traffic.
VulnCheck identified six scanner IPs and one dedicated OAST host, all operating from Google Cloud. The OAST server at 34.136.22.26 has been running Interactsh services across multiple ports for at least a year, since November 2024.
The attacker uses custom payloads in addition to standard Nuclei templates to show their skills. Researchers found a modified TouchFile.class Java exploit file on the attacker’s server.
This file extends the standard Fastjson 1.2.47 exploitation method with additional command execution and HTTP callback functionality.
The attacker uses old Nuclei templates that have been removed from official repositories, indicating they keep a modified scanning toolkit instead of just using public tools.
Indicators of Compromise:
Organizations should monitor for connections to detectors-testing.com and its subdomains.
The following Google Cloud IP addresses have been associated with this campaign: 34.172.194.72, 35.194.0.176, 34.133.225.171, 34.68.101.3, 34.42.21.27, 34.16.7.161, and 34.136.22.26.
Security teams must patch all internet-facing applications against known vulnerabilities, especially the 200+ actively exploited CVEs.
Network monitoring for unusual OAST callbacks and regular vulnerability assessments are crucial defenses against ongoing scanning attacks.