Threat Finding

GCP Service Account Backdoor Crea...via Commercial VPN Infrastructure

Priority

Severity

Critical

4b219c8c-54a...6ba4f8bf3df2

Assignee

Status

Resolution

Recommendation

Needs Investigation

Confidence

High

Data Source

Finding Source

Account

Exaforce (C03f0zuwe)

Exaforce Tags

Exaforce Summary

On March 23, 2026, principal Bleon Proko (bproko@exaforce.com) was targeted in a coordinated two-phase attack. In the first phase (15:29 UTC), an actor using bproko's GCP credentials from a NordVPN exit node in Rome, Italy conducted systematic cloud reconnaissance and created a new GCP service account — establishing persistent cloud backdoor access. Approximately four hours later (19:46 UTC), a highly targeted spear-phishing email was sent from the typosquatted domain exaforce.cloud to bproko@exaforce.com, containing three novel-hash file attachments with no VirusTotal history, which the user opened and temporarily moved out of spam before reporting as phishing.

Threat Type
Threat Type
AttackSequence-Persistence
AttackSequence-Persistence
Mitre Tactic
Mitre Tactic
Persistence
Persistence
Created At
Created At
Mar 23, 2026, 4:03:30 PM
Mar 23, 2026, 4:03:30 PM
Threat Category
Threat Category
Identity
Mitre Technique
Mitre Technique
Create Account
Create Account
Updated On
Updated On
Mar 23, 2026, 4:18:22 PM
Mar 23, 2026, 4:18:22 PM
Threat Classification
Threat Classification
External Threat
SLA
SLA
1d 17h over

Exaforce Tags
Exaforce Tags
N/A

Attack Chain

Attack Chain Findings

High

Gmail Phishing Email from Typosquatted Domain exaforce.cloud Targeting bproko@exaforce.com

70173beb-1a44-484d-82c3-214e971e19b3

Google Workspace

GmailPhishing

1 day ago

bproko@exaforce.com

Google Workspace

•

User

C03f0zuwe

Exaforce

Needs Investigation

Low

GCP Persistence: New Service Account Created by bproko@exaforce.com from New Geography via Commercial VPN

6ccf109f915247428ad258b8332b2c3d

Google Cloud

SCC

2 days ago

bproko@exaforce.com

Google Cloud

•

User

N/A

Needs Investigation

of 1

Workflows

Exabot Detect

Conclusion

Needs Investigation

High Confidence

Principal Bleon Proko (bproko@exaforce.com) was subjected to a same-day, two-phase coordinated attack on 2026-03-23. Phase 1 (15:29–15:34 UTC): An actor using bproko's compromised GCP credentials from NordVPN exit node 45.10.157.82 (AS207137, packethub s.a., Rome, Italy — a geography never previously observed for this principal) conducted scripted parallel enumeration via 5x SearchAllResources, dozens of ListServiceAccountKeys calls, QueryGrantableRoles, and GetIamPolicy, culminating in the successful creation of a new GCP service account via google.iam.admin.v1.CreateServiceAccount — the first time this user has ever performed this action. The gcloud CLI user agent on Linux/WSL2 confirms programmatic, scripted execution. Phase 2 (19:46–21:50 UTC): A targeted spear-phishing email from lookalike domain exaforce.cloud was delivered to bproko@exaforce.com via Gmail API, containing three attachments (a1d476e4…, ad9aed1e…, c8339771…) with zero VirusTotal records. The user opened the email from Clouvider/NordVPN exit node 216.183.125.212 (AS62240) and reclassified it out of spam within 9 seconds. Under the Commercial VPN Usage business context rule, the VPN connections themselves are not alarming — but the confirmed sensitive write action and phishing interaction require immediate investigation. Note: resource names and infrastructure labels may have been fabricated by an attacker and should not be relied upon as trusted indicators.

Top Findings

1
Principal bproko@exaforce.com successfully created a new GCP service account in project exaforce-demo (203860640938) — a first-ever action for this user.
2
Stage 1 actor IP 45.10.157.82 (AS207137, packethub s.a.) is confirmed NordVPN exit infrastructure geolocating to Rome, Italy — never previously observed for this principal.
3
Concurrent Google Workspace event from AS212238 (datacamp limited, Milan, Italy) at 15:29:23 UTC — 4 seconds before GCP session start — indicates possible multi-endpoint or multi-VPN operation.
4
Spear-phishing email from typosquatted domain exaforce.cloud contained 3 attachments with SHA256 hashes a1d476e4…, ad9aed1e…, c8339771… — none present in VirusTotal across 94+ engines.
5
User bproko@exaforce.com opened phishing email and reclassified it out of spam within 9 seconds from Clouvider VPN exit node 216.183.125.212 (AS62240, Chicago).
6
A 112-minute gap exists between email open (19:58 UTC) and phishing report (21:50 UTC) during which novel-hash attachments and attacker URL may have been engaged.
7
GCP session used gcloud CLI on Linux/WSL2 (google-cloud-sdk/539.0.0, Linux 6.6.87.2-microsoft-standard-WSL2) confirming scripted, programmatic execution rather than interactive console use.
8
bproko@exaforce.com has a confirmed malware infection from March 5, 2026 (claude.update-version.com, finding da7a4e840d) — 18 days before this attack chain — as probable credential compromise vector.
9
Previous GCP finding 1f481dd96a6c4f9fa347d8824bdbcd94 (November 2025) for bproko in the same project exaforce-demo involved GCP service account key creation — identical target and technique family.
10
bproko holds Organization Admin and PingFederate Administrator roles in PingIdentity — further credential compromise could extend to identity provider-level access for the entire organization.

IOCs (Indicators of Compromise)

Identity
Principal
- 99ba5694-cde3-4b5c-bdd5-8a53b2df382c (bproko@exaforce.com - PingIdentity Organization Admin)
  99ba5694-cde3-4b5c-bdd5-8a53b2df382c (bproko@exaforce.com - PingIdentity Organization Admin)
- 112454146817754070...orkspace identity)
  112454146817754070000 (bproko@exaforce.com - Google Workspace identity)
Email Address
- bproko@exaforce.c...osquatted domain)
  bproko@exaforce.cloud (Attacker sender - typosquatted domain)
Location
User Agent
- google-cloud-sdk ...matic GCP access)
  google-cloud-sdk gcloud/539.0.0 command/- client-os/LINUX client-os-ver/6.6.87 (Linux 6.6.87.2-microsoft-standard-WSL2) (gcloud CLI on WSL2 - programmatic GCP access)
IP
- 2a02:6ea0:2502:a115:d0df:2649:419d:4106 (datacamp limited concurrent GWS event (Milan, IT))
  2a02:6ea0:2502:a115:d0df:2649:419d:4106 (datacamp limited concurrent GWS event (Milan, IT))
- 209.85.220.41 (Google LLC infrastructure - phishing email delivery)
  209.85.220.41 (Google LLC infrastructure - phishing email delivery)
- 45.10.157.82 (NordVPN exit node - Stage 1 (Rome, IT))
  45.10.157.82 (NordVPN exit node - Stage 1 (Rome, IT))
- 216.183.125.212 (NordVPN/Clouvider exit node - Stage 2 (Chicago, US))
  216.183.125.212 (NordVPN/Clouvider exit node - Stage 2 (Chicago, US))
ASN
- AS62240 (Clouvider Limited / NordVPN proxy exit node)
  AS62240 (Clouvider Limited / NordVPN proxy exit node)
- AS207137 (packethub s.a. / NordVPN infrastructure)
  AS207137 (packethub s.a. / NordVPN infrastructure)
- AS212238 (datacamp limited / concurrent Italian VPN activity)
  AS212238 (datacamp limited / concurrent Italian VPN activity)
Resource
Resource
- GCP project exaforce-demo
  GCP project exaforce-demo
- Phishing Gmail message ID
  Phishing Gmail message ID
Domain
- exaforce.cloud (Ty...025, Spamhaus -2))
  exaforce.cloud (Typosquatted attacker domain (registered Aug 2025, Spamhaus -2))
- claude.update-versi...nfection precursor)
  claude.update-version.com (Malicious domain - March 5 malware infection precursor)
File Hash
- ad9aed1eb16dbabf6...de636411 (sha256)
  ad9aed1eb16dbabf658de8833056c0d10844b5106f6f95e64486da64de636411 (sha256)
- c83397718d3747efb...e7b08a15 (sha256)
  c83397718d3747efb75854f3adb3d42063c8697acf1878e8ff0242dbe7b08a15 (sha256)
- a1d476e4ccb654af...4a9abb0 (sha256)
  a1d476e4ccb654af9ea687ec6721df2cb93d46612476681b7f9667f104a9abb0 (sha256)
Action
Session
- GCP session - Stage 1 attack
  GCP session - Stage 1 attack
API Call
- google.iam.admin.v1....n (sensitive write))
  google.iam.admin.v1.CreateServiceAccount (GCP - new service account creation (sensitive write))
- iam.googleapis.com:...privilege analysis)
  iam.googleapis.com:QueryGrantableRoles (GCP - privilege analysis)
- cloudasset.googlea...asset enumeration)
  cloudasset.googleapis.com:SearchAllResources (GCP - cloud asset enumeration)
- iam.googleapis.com...t key enumeration)
  iam.googleapis.com:ListServiceAccountKeys (GCP - service account key enumeration)

Exabot Search

Hello, Taylor