{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "The Bissa scanner converts internet-scale scanning into reliable, high-value compromises; a negative result over the exfiltration and credential-use surfaces confirms the organization has not been operationalized by the threat actor."
      },
      "name": "Bissa Scanner C2 and S3 Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1102.002",
        "attack.t1071.001",
        "attack.t1567.002",
        "attack.t1078.004",
        "attack.t1528"
      ],
      "series": {
        "slug": "bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting",
        "index": 2,
        "title": "Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting",
        "total": 2
      },
      "related": [
        {
          "hunt": "bissa-scanner-initial-exploitation",
          "reason": "Initial exploitation occurs prior to the alerting and exfiltration phases covered here.",
          "relation": "follows"
        },
        {
          "hunt": "bissa-scanner-exploitation-harvesting",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A simple rule for Telegram or S3 traffic creates too much noise. This hunt correlates the vulnerable state of a host with specific egress behaviors and rare identity patterns to find the malicious overlap that automated rules would miss.",
      "coverage": [
        {
          "stage": "c2-telegram-alerting",
          "steps": [
            "network-egress-to-c2-and-exfil"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-to-filebase-s3",
          "steps": [
            "network-egress-to-c2-and-exfil"
          ],
          "status": "covered"
        },
        {
          "stage": "credential-abuse-saas-cloud",
          "steps": [
            "identity-access-anomalies"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-mass-exploitation",
          "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "execution-credential-enumeration-payload",
          "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "collection-data-staging",
          "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Mass Vulnerability Exploitation",
            "slug": "initial-access-mass-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "CVE-2025-55182",
              "CVE-2025-9501",
              "React Server Function endpoints",
              "W3 Total Cache _parse_dynamic_mfunc payload",
              "denemekulubum.com.tr/acquirer/",
              "wiprz.com/acquirer/",
              "cs2.ip.thc.org"
            ]
          },
          {
            "name": "Local Credential and Metadata Enumeration",
            "slug": "execution-credential-enumeration-payload",
            "tactic": "execution",
            "techniques": [
              "T1059.004",
              "T1083"
            ],
            "observables": [
              ".env file enumeration",
              "Kubernetes service account context retrieval",
              "Cloud metadata service (IMDS) access",
              "Local database and Redis credential search",
              "Cryptocurrency wallet search"
            ]
          },
          {
            "name": "Telegram Bot Command and Control",
            "slug": "c2-telegram-alerting",
            "tactic": "command-and-control",
            "techniques": [
              "T1102.002",
              "T1071.001"
            ],
            "observables": [
              "api.telegram.org",
              "@bissapwned_bot",
              "@bissa_scan_bot",
              "Bot ID 8798206332",
              "Chat ID 1609309278"
            ]
          },
          {
            "name": "Archive Staging of Environment Files",
            "slug": "collection-data-staging",
            "tactic": "collection",
            "techniques": [
              "T1560.001"
            ],
            "observables": [
              "results/ directory monitoring",
              "env-batch-*.zip",
              "Batching of .env files into ZIP archives"
            ]
          },
          {
            "name": "Exfiltration to Filebase S3",
            "slug": "exfiltration-to-filebase-s3",
            "tactic": "exfiltration",
            "techniques": [
              "T1567.002"
            ],
            "observables": [
              "s3.filebase.com",
              "bucket: bissapromax",
              "prefix: archives/"
            ]
          },
          {
            "name": "Post-Compromise Credential Abuse",
            "slug": "credential-abuse-saas-cloud",
            "tactic": "credential-access",
            "techniques": [
              "T1078.004",
              "T1528"
            ],
            "observables": [
              "Anthropic API keys",
              "AWS access keys",
              "Okta/Auth0 tokens",
              "Stripe/PayPal tokens",
              "GitHub personal access tokens",
              "Slack integration tokens",
              "Oracle Fusion REST export activity"
            ]
          }
        ],
        "summary": "The Bissa Scanner campaign involves large-scale, automated exploitation of React Server Components (CVE-2025-55182) and WordPress (CVE-2025-9501) to harvest secrets at scale. The operator, 'Dr. Tube', utilizes AI-assisted workflows via Claude Code and OpenClaw to triage stolen data and automate alerting through Telegram bots, eventually exfiltrating credentials to S3-compatible Filebase storage."
      },
      "severity": "high",
      "rationale": "The hunt begins by identifying hostnames vulnerable to CVE-2025-55182 or CVE-2025-9501 and joining them with the device inventory to ensure portability across telemetry surfaces. Pivot the identity search on any users or IPs associated with those vulnerable servers.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker is using Telegram for command-and-control alerts and Filebase S3 for data exfiltration after harvesting secrets from vulnerable application servers.",
      "parameters": {
        "cve_ids": {
          "from": {
            "ref": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/",
            "kind": "article",
            "observed": "2026-04-22"
          },
          "type": "list[string]",
          "default": [
            "CVE-2025-55182",
            "CVE-2025-9501"
          ],
          "description": "CVEs used by Bissa scanner to gain initial access."
        },
        "scope_ips": {
          "from": {
            "ref": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/",
            "kind": "article",
            "observed": "2026-04-22"
          },
          "type": "list[ip]",
          "default": [],
          "description": "Source IPs of the vulnerable hosts to pivot on SaaS login activity."
        },
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Limit the behavioral hunt to these hostnames; populate from the first step."
        },
        "scope_users": {
          "type": "list[string]",
          "default": [],
          "description": "User accounts seen on vulnerable hosts to pivot on SaaS login activity."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "saas_providers": {
          "type": "list[string]",
          "default": [
            "aws",
            "okta",
            "github",
            "azure",
            "anthropic",
            "openai",
            "mistral",
            "stripe",
            "paypal",
            "auth0"
          ],
          "description": "SaaS and cloud providers targeted by the Bissa credential haul."
        },
        "c2_and_exfil_domains": {
          "from": {
            "ref": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/",
            "kind": "article",
            "observed": "2026-04-22"
          },
          "type": "list[domain]",
          "default": [
            "api.telegram.org",
            "s3.filebase.com"
          ],
          "description": "Domains used for Telegram alerting and S3 exfiltration."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/",
          "name": "The DFIR Report - Bissa Scanner Exposed"
        }
      ],
      "blind_spots": [
        {
          "id": "no-network-visibility",
          "risk": "Exfiltration from unmonitored segments will not be detected.",
          "stage": "exfiltration-to-filebase-s3",
          "question": "whether hosts in unmonitored segments are talking to Filebase",
          "requires": "hb_network_connection or hb_dns_activity on all cloud VPCs"
        },
        {
          "id": "unknown-auth-source",
          "risk": "Adversaries using residential proxies might blend in with legitimate user activity.",
          "stage": "credential-abuse-saas-cloud",
          "question": "whether a login attempt from a specific IP belongs to the attacker",
          "requires": "hb_auth_signin with source IP attribution"
        }
      ]
    },
    "name": "Bissa Scanner C2 and S3 Exfiltration",
    "description": "This hunt targets the post-compromise egress and exfiltration phase of the Bissa scanner operation. The operator uses Telegram bots for real-time alerting and S3-compatible Filebase buckets to archive stolen environment files. By scoping to hosts with known React or WordPress vulnerabilities and monitoring for specific network and identity anomalies, the hunt detects the transition from initial access to full-scale credential abuse in cloud and SaaS environments."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting",
          "index": 2,
          "title": "Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting",
          "total": 2
        },
        "coverage": [
          {
            "stage": "c2-telegram-alerting",
            "steps": [
              "network-egress-to-c2-and-exfil"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-to-filebase-s3",
            "steps": [
              "network-egress-to-c2-and-exfil"
            ],
            "status": "covered"
          },
          {
            "stage": "credential-abuse-saas-cloud",
            "steps": [
              "identity-access-anomalies"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-mass-exploitation",
            "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "execution-credential-enumeration-payload",
            "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "collection-data-staging",
            "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An attacker is using Telegram for command-and-control alerts and Filebase S3 for data exfiltration after harvesting secrets from vulnerable application servers.",
        "blind_spots": [
          {
            "id": "no-network-visibility",
            "risk": "Exfiltration from unmonitored segments will not be detected.",
            "stage": "exfiltration-to-filebase-s3",
            "question": "whether hosts in unmonitored segments are talking to Filebase",
            "requires": "hb_network_connection or hb_dns_activity on all cloud VPCs"
          },
          {
            "id": "unknown-auth-source",
            "risk": "Adversaries using residential proxies might blend in with legitimate user activity.",
            "stage": "credential-abuse-saas-cloud",
            "question": "whether a login attempt from a specific IP belongs to the attacker",
            "requires": "hb_auth_signin with source IP attribution"
          }
        ],
        "scoping_notes": "The hunt begins by identifying hostnames vulnerable to CVE-2025-55182 or CVE-2025-9501 and joining them with the device inventory to ensure portability across telemetry surfaces. Pivot the identity search on any users or IPs associated with those vulnerable servers.",
        "beyond_detection": "A simple rule for Telegram or S3 traffic creates too much noise. This hunt correlates the vulnerable state of a host with specific egress behaviors and rare identity patterns to find the malicious overlap that automated rules would miss."
      }
    },
    {
      "id": "identify-vulnerable-exposure",
      "type": "query",
      "label": "Identify vulnerable exposure",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT d.hostname AS device_hostname, v.cve_uid, v.affected_package_name, v.affected_package_version, v.severity FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (instr(',' || '{{cve_ids}}' || ',', ',' || v.cve_uid || ',') > 0)",
        "surface": "hb_vulnerability_finding",
        "description": "Find hostnames currently reporting the CVEs associated with the Bissa scanner to prioritize the network hunt.",
        "expected_signal": "A list of hostnames with vulnerable React or WordPress components. Silence means no known vulnerable surface in the current inventory."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable exposure",
        "reads": [
          "device_uid",
          "cve_uid",
          "affected_package_name",
          "affected_package_version",
          "severity"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT d.hostname AS device_hostname, v.cve_uid, v.affected_package_name, v.affected_package_version, v.severity FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (instr(',' || '{{cve_ids}}' || ',', ',' || v.cve_uid || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames with vulnerable React or WordPress components. Silence means no known vulnerable surface in the current inventory.",
        "verified": "dry-run",
        "verified_at": "2026-09-23"
      }
    },
    {
      "id": "network-egress-to-c2-and-exfil",
      "type": "query",
      "label": "Network egress to C2 and exfil",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) as lookup_count, MIN(time) as first_lookup FROM hb_dns_activity WHERE (instr(',' || '{{c2_and_exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3",
        "surface": "hb_dns_activity",
        "description": "Find DNS resolutions for Telegram and Filebase S3 from hosts in the vulnerable scope.",
        "expected_signal": "An application server or developer machine resolving Filebase S3 or Telegram API domains. Silence means no egress to the reported operator infrastructure was observed."
      },
      "parents": [
        {
          "id": "identify-vulnerable-exposure"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Network egress to C2 and exfil",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, COUNT(*) as lookup_count, MIN(time) as first_lookup FROM hb_dns_activity WHERE (instr(',' || '{{c2_and_exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3",
        "silence": "not_evidence_of_absence",
        "expected": "An application server or developer machine resolving Filebase S3 or Telegram API domains. Silence means no egress to the reported operator infrastructure was observed.",
        "verified": "dry-run",
        "verified_at": "2026-09-23"
      }
    },
    {
      "id": "identity-access-anomalies",
      "type": "query",
      "label": "Identity access anomalies",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "identity",
        "content": "SELECT provider, actor_user_name, src_endpoint_ip, activity_name, COUNT(*) as event_count, MIN(time) as first_seen FROM hb_auth_signin WHERE (instr(',' || '{{saas_providers}}' || ',', ',' || LOWER(provider) || ',') > 0) AND (('{{scope_ips}}' = '' OR instr(',' || '{{scope_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) OR ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING event_count < 10",
        "surface": "hb_auth_signin",
        "description": "Identify rare authentication events for the SaaS providers targeted by Bissa, pivoting on identities found in the scoping step.",
        "expected_signal": "Low-frequency authentication events from unusual source IPs for sensitive providers. Silence means no suspicious login activity was captured for the prioritized identities."
      },
      "parents": [
        {
          "id": "identify-vulnerable-exposure"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Identity access anomalies",
        "reads": [
          "provider",
          "actor_user_name",
          "src_endpoint_ip",
          "activity_name",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT provider, actor_user_name, src_endpoint_ip, activity_name, COUNT(*) as event_count, MIN(time) as first_seen FROM hb_auth_signin WHERE (instr(',' || '{{saas_providers}}' || ',', ',' || LOWER(provider) || ',') > 0) AND (('{{scope_ips}}' = '' OR instr(',' || '{{scope_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) OR ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING event_count < 10",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "Low-frequency authentication events from unusual source IPs for sensitive providers. Silence means no suspicious login activity was captured for the prioritized identities.",
        "verified": "dry-run",
        "prevalence": {
          "by": "src_endpoint_ip",
          "key": [
            "actor_user_name",
            "provider"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-23"
      }
    },
    {
      "id": "triage-operator-activity",
      "type": "analytic",
      "label": "Triage operator activity",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity"
        ],
        "context": [
          "identify-vulnerable-exposure",
          "network-egress-to-c2-and-exfil",
          "identity-access-anomalies"
        ],
        "objective": "Confirm an active Bissa compromise and identify whether an attacker is using stolen credentials by analyzing vulnerable findings, DNS egress to command-and-control infrastructure, and anomalous logins to cloud or SaaS providers.",
        "description": "Weigh the vulnerable scope, network egress, and identity anomalies to confirm an active Bissa compromise.",
        "max_iterations": 5,
        "expected_signal": "A prioritized list of compromised hosts and compromised SaaS accounts.",
        "success_criteria": "A verdict of malicious | suspicious | benign per host and user account, citing DNS rows and authentication logs."
      },
      "parents": [
        {
          "id": "network-egress-to-c2-and-exfil",
          "kind": "merge"
        },
        {
          "id": "identity-access-anomalies",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "threat-response-decision",
      "type": "checkpoint",
      "label": "Threat response decision",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "The triage verdict is malicious for at least one host or SaaS account, indicating an attacker is using stolen credentials.",
        "condition": "The triage verdict is malicious for at least one host or SaaS account, indicating an attacker is using stolen credentials.",
        "blind_spot": "no-network-visibility",
        "confidence": "high",
        "description": "Route confirmed malicious activity to immediate containment.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-operator-activity"
        }
      ]
    },
    {
      "id": "contain-and-revoke",
      "type": "action",
      "label": "Contain and revoke",
      "config": {
        "target": "endpoint",
        "description": "Stop active exfiltration and invalidate stolen secrets.",
        "instructions": "Isolate the affected host from the network. Invalidate and rotate all credentials associated with the compromised user or found in .env files, especially for AWS, Okta, and GitHub. Initiate a password reset for any identity suspected of being compromised.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "threat-response-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "forensic-artifact-review",
      "type": "task",
      "label": "Forensic artifact review",
      "config": {
        "assignee": "analyst",
        "description": "Collect evidence from the compromised host to confirm the extent of the exfiltration.",
        "instructions": "Examine the local results directory on the host. Look for ZIP files following the env-batch-*.zip pattern and runner scripts referencing the bissapromax bucket or Telegram bot user ID 8798206332."
      },
      "parents": [
        {
          "id": "threat-response-decision",
          "branch": "default"
        },
        {
          "id": "threat-response-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-and-revoke"
        }
      ]
    },
    {
      "id": "close-out-report",
      "type": "task",
      "label": "Close out report",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and remediation results.",
        "instructions": "Document which data clusters were potentially accessed. Recommend moving secrets out of .env files and into a dedicated secret manager for all production services."
      },
      "parents": [
        {
          "id": "threat-response-decision",
          "branch": "on_refutes"
        },
        {
          "id": "forensic-artifact-review"
        }
      ]
    }
  ]
}