--- analysis: A simple rule for Telegram or S3 traffic creates too much noise. This hunt correlates the vulnerable state of a host with specific egress behaviors and rare identity patterns to find the malicious overlap that automated rules would miss. blind_spots: - id: no-network-visibility question: whether hosts in unmonitored segments are talking to Filebase requires: hb_network_connection or hb_dns_activity on all cloud VPCs risk: Exfiltration from unmonitored segments will not be detected. stage: exfiltration-to-filebase-s3 - id: unknown-auth-source question: whether a login attempt from a specific IP belongs to the attacker requires: hb_auth_signin with source IP attribution risk: Adversaries using residential proxies might blend in with legitimate user activity. stage: credential-abuse-saas-cloud coverage: - stage: c2-telegram-alerting status: covered steps: - network-egress-to-c2-and-exfil - stage: exfiltration-to-filebase-s3 status: covered steps: - network-egress-to-c2-and-exfil - stage: credential-abuse-saas-cloud status: covered steps: - identity-access-anomalies - reason: 'Belongs to another part of the ''Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting'' series.' stage: initial-access-mass-exploitation status: out_of_scope - reason: 'Belongs to another part of the ''Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting'' series.' stage: execution-credential-enumeration-payload status: out_of_scope - reason: 'Belongs to another part of the ''Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting'' series.' stage: collection-data-staging status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The Bissa scanner converts internet-scale scanning into reliable, high-value compromises; a negative result over the exfiltration and credential-use surfaces confirms the organization has not been operationalized by the threat actor. methodology: model-assisted trigger: intel-report hypothesis: An attacker is using Telegram for command-and-control alerts and Filebase S3 for data exfiltration after harvesting secrets from vulnerable application servers. labels: - hunt - attack.t1102.002 - attack.t1071.001 - attack.t1567.002 - attack.t1078.004 - attack.t1528 name: Bissa Scanner C2 and S3 Exfiltration parameters: c2_and_exfil_domains: default: - api.telegram.org - s3.filebase.com description: Domains used for Telegram alerting and S3 exfiltration. from: kind: article observed: '2026-04-22' ref: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/ type: list[domain] cve_ids: default: - CVE-2025-55182 - CVE-2025-9501 description: CVEs used by Bissa scanner to gain initial access. from: kind: article observed: '2026-04-22' ref: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/ type: list[string] lookback_days: default: '14' description: Days of history to examine. type: number saas_providers: default: - aws - okta - github - azure - anthropic - openai - mistral - stripe - paypal - auth0 description: SaaS and cloud providers targeted by the Bissa credential haul. type: list[string] scope_hosts: default: [] description: Limit the behavioral hunt to these hostnames; populate from the first step. type: list[host] scope_ips: default: [] description: Source IPs of the vulnerable hosts to pivot on SaaS login activity. from: kind: article observed: '2026-04-22' ref: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/ type: list[ip] scope_users: default: [] description: User accounts seen on vulnerable hosts to pivot on SaaS login activity. type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: The hunt begins by identifying hostnames vulnerable to CVE-2025-55182 or CVE-2025-9501 and joining them with the device inventory to ensure portability across telemetry surfaces. Pivot the identity search on any users or IPs associated with those vulnerable servers. references: - name: The DFIR Report - Bissa Scanner Exposed url: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/ related: - hunt: bissa-scanner-initial-exploitation reason: Initial exploitation occurs prior to the alerting and exfiltration phases covered here. relation: follows - hunt: bissa-scanner-exploitation-harvesting relation: follows scenario: stages: - name: Mass Vulnerability Exploitation observables: - CVE-2025-55182 - CVE-2025-9501 - React Server Function endpoints - W3 Total Cache _parse_dynamic_mfunc payload - denemekulubum.com.tr/acquirer/ - wiprz.com/acquirer/ - cs2.ip.thc.org slug: initial-access-mass-exploitation tactic: initial-access techniques: - T1190 - name: Local Credential and Metadata Enumeration observables: - .env file enumeration - Kubernetes service account context retrieval - Cloud metadata service (IMDS) access - Local database and Redis credential search - Cryptocurrency wallet search slug: execution-credential-enumeration-payload tactic: execution techniques: - T1059.004 - T1083 - name: Telegram Bot Command and Control observables: - api.telegram.org - '@bissapwned_bot' - '@bissa_scan_bot' - Bot ID 8798206332 - Chat ID 1609309278 slug: c2-telegram-alerting tactic: command-and-control techniques: - T1102.002 - T1071.001 - name: Archive Staging of Environment Files observables: - results/ directory monitoring - env-batch-*.zip - Batching of .env files into ZIP archives slug: collection-data-staging tactic: collection techniques: - T1560.001 - name: Exfiltration to Filebase S3 observables: - s3.filebase.com - 'bucket: bissapromax' - 'prefix: archives/' slug: exfiltration-to-filebase-s3 tactic: exfiltration techniques: - T1567.002 - name: Post-Compromise Credential Abuse observables: - Anthropic API keys - AWS access keys - Okta/Auth0 tokens - Stripe/PayPal tokens - GitHub personal access tokens - Slack integration tokens - Oracle Fusion REST export activity slug: credential-abuse-saas-cloud tactic: credential-access techniques: - T1078.004 - T1528 summary: The Bissa Scanner campaign involves large-scale, automated exploitation of React Server Components (CVE-2025-55182) and WordPress (CVE-2025-9501) to harvest secrets at scale. The operator, 'Dr. Tube', utilizes AI-assisted workflows via Claude Code and OpenClaw to triage stolen data and automate alerting through Telegram bots, eventually exfiltrating credentials to S3-compatible Filebase storage. series: index: 2 slug: bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting title: 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity tlp: clear type: investigation --- # Bissa Scanner C2 and S3 Exfiltration This hunt targets the post-compromise egress and exfiltration phase of the Bissa scanner operation. The operator uses Telegram bots for real-time alerting and S3-compatible Filebase buckets to archive stolen environment files. By scoping to hosts with known React or WordPress vulnerabilities and monitoring for specific network and identity anomalies, the hunt detects the transition from initial access to full-scale credential abuse in cloud and SaaS environments. ## identify-vulnerable-exposure Find hostnames currently reporting the CVEs associated with the Bissa scanner to prioritize the network hunt. ```sqlite target=endpoint role=scoping params=(cve_ids=cve_ids) ~~~yaml expected: A list of hostnames with vulnerable React or WordPress components. Silence means no known vulnerable surface in the current inventory. reads: - device_uid - cve_uid - affected_package_name - affected_package_version - severity silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-09-23' ~~~ SELECT d.hostname AS device_hostname, v.cve_uid, v.affected_package_name, v.affected_package_version, v.severity FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (instr(',' || '{{cve_ids}}' || ',', ',' || v.cve_uid || ',') > 0) ``` ## check-for-egress-and-abuse parallel: - → network-egress-to-c2-and-exfil - → identity-access-anomalies join: → triage-operator-activity ## network-egress-to-c2-and-exfil Find DNS resolutions for Telegram and Filebase S3 from hosts in the vulnerable scope. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, c2_and_exfil_domains=c2_and_exfil_domains, scope_hosts=scope_hosts) ~~~yaml expected: An application server or developer machine resolving Filebase S3 or Telegram API domains. Silence means no egress to the reported operator infrastructure was observed. reads: - device_hostname - query_hostname - process_name - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-23' ~~~ SELECT device_hostname, query_hostname, process_name, COUNT(*) as lookup_count, MIN(time) as first_lookup FROM hb_dns_activity WHERE (instr(',' || '{{c2_and_exfil_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3 ``` ## identity-access-anomalies Identify rare authentication events for the SaaS providers targeted by Bissa, pivoting on identities found in the scoping step. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days, saas_providers=saas_providers, scope_ips=scope_ips, scope_users=scope_users) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Low-frequency authentication events from unusual source IPs for sensitive providers. Silence means no suspicious login activity was captured for the prioritized identities. prevalence: by: src_endpoint_ip key: - actor_user_name - provider rare_below: 3 reads: - provider - actor_user_name - src_endpoint_ip - activity_name - time silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-09-23' ~~~ SELECT provider, actor_user_name, src_endpoint_ip, activity_name, COUNT(*) as event_count, MIN(time) as first_seen FROM hb_auth_signin WHERE (instr(',' || '{{saas_providers}}' || ',', ',' || LOWER(provider) || ',') > 0) AND (('{{scope_ips}}' = '' OR instr(',' || '{{scope_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) OR ('{{scope_users}}' = '' OR instr(',' || '{{scope_users}}' || ',', ',' || actor_user_name || ',') > 0)) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING event_count < 10 ``` ## triage-operator-activity ```agent target=hunter cite: required context: - identify-vulnerable-exposure - network-egress-to-c2-and-exfil - identity-access-anomalies max_iterations: 5 objective: Confirm an active Bissa compromise and identify whether an attacker is using stolen credentials by analyzing vulnerable findings, DNS egress to command-and-control infrastructure, and anomalous logins to cloud or SaaS providers. success_criteria: A verdict of malicious | suspicious | benign per host and user account, citing DNS rows and authentication logs. tools: - endpoint - identity ``` ## threat-response-decision if~: "The triage verdict is malicious for at least one host or SaaS account, indicating an attacker is using stolen credentials." (confidence: high, judge=hunter) then: → contain-and-revoke indeterminate: → forensic-artifact-review unavailable: → forensic-artifact-review (blind_spot: no-network-visibility) else: → close-out-report ## contain-and-revoke ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the affected host from the network. Invalidate and rotate all credentials associated with the compromised user or found in .env files, especially for AWS, Okta, and GitHub. Initiate a password reset for any identity suspected of being compromised. ``` → forensic-artifact-review ## forensic-artifact-review ```manual target=analyst Examine the local results directory on the host. Look for ZIP files following the env-batch-*.zip pattern and runner scripts referencing the bissapromax bucket or Telegram bot user ID 8798206332. ``` → close-out-report ## close-out-report ```manual target=analyst Document which data clusters were potentially accessed. Recommend moving secrets out of .env files and into a dedicated secret manager for all production services. ``` → end