{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Bissa scanner operation has successfully compromised over 900 organizations. Confirming the absence of automated harvest behavior on vulnerable web servers provides significant risk reduction." }, "name": "Bissa Scanner Mass Exploitation and Credential Harvesting", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1059.004", "attack.t1083", "attack.t1560.001" ], "series": { "slug": "bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting", "index": 1, "title": "Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting", "total": 2 }, "related": [ { "hunt": "bissa-scanner-c2-telegram", "reason": "This hunt focuses on endpoint behavior; the Telegram hunt focuses on the C2 alerting channel.", "relation": "out-of-scope-alternative" }, { "hunt": "bissa-scanner-exfiltration-filebase", "reason": "This hunt identifies staging; the exfiltration hunt identifies the subsequent move to S3 storage.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might alert on the Bissa ZIP file, but this hunt pivots between the vulnerability posture and behavioral anomalies like rare process interaction with secrets. This distinguishes a focused Bissa exploit from routine administrative actions or generic web noise.", "coverage": [ { "stage": "initial-access-mass-exploitation", "steps": [ "vulnerability-lead" ], "status": "covered" }, { "stage": "execution-credential-enumeration-payload", "steps": [ "env-access-prevalence" ], "status": "covered" }, { "stage": "collection-data-staging", "steps": [ "staging-zip-creation" ], "status": "covered" }, { "stage": "c2-telegram-alerting", "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.", "status": "out_of_scope" }, { "stage": "exfiltration-to-filebase-s3", "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.", "status": "out_of_scope" }, { "stage": "credential-abuse-saas-cloud", "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Mass Vulnerability Exploitation", "slug": "initial-access-mass-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2025-55182", "CVE-2025-9501", "React Server Function endpoints", "W3 Total Cache _parse_dynamic_mfunc payload", "denemekulubum.com.tr/acquirer/", "wiprz.com/acquirer/", "cs2.ip.thc.org" ] }, { "name": "Local Credential and Metadata Enumeration", "slug": "execution-credential-enumeration-payload", "tactic": "execution", "techniques": [ "T1059.004", "T1083" ], "observables": [ ".env file enumeration", "Kubernetes service account context retrieval", "Cloud metadata service (IMDS) access", "Local database and Redis credential search", "Cryptocurrency wallet search" ] }, { "name": "Telegram Bot Command and Control", "slug": "c2-telegram-alerting", "tactic": "command-and-control", "techniques": [ "T1102.002", "T1071.001" ], "observables": [ "api.telegram.org", "@bissapwned_bot", "@bissa_scan_bot", "Bot ID 8798206332", "Chat ID 1609309278" ] }, { "name": "Archive Staging of Environment Files", "slug": "collection-data-staging", "tactic": "collection", "techniques": [ "T1560.001" ], "observables": [ "results/ directory monitoring", "env-batch-*.zip", "Batching of .env files into ZIP archives" ] }, { "name": "Exfiltration to Filebase S3", "slug": "exfiltration-to-filebase-s3", "tactic": "exfiltration", "techniques": [ "T1567.002" ], "observables": [ "s3.filebase.com", "bucket: bissapromax", "prefix: archives/" ] }, { "name": "Post-Compromise Credential Abuse", "slug": "credential-abuse-saas-cloud", "tactic": "credential-access", "techniques": [ "T1078.004", "T1528" ], "observables": [ "Anthropic API keys", "AWS access keys", "Okta/Auth0 tokens", "Stripe/PayPal tokens", "GitHub personal access tokens", "Slack integration tokens", "Oracle Fusion REST export activity" ] } ], "summary": "The Bissa Scanner campaign involves large-scale, automated exploitation of React Server Components (CVE-2025-55182) and WordPress (CVE-2025-9501) to harvest secrets at scale. The operator, 'Dr. Tube', utilizes AI-assisted workflows via Claude Code and OpenClaw to triage stolen data and automate alerting through Telegram bots, eventually exfiltrating credentials to S3-compatible Filebase storage." }, "severity": "high", "rationale": "Focus on internet-facing assets reporting CVE-2025-55182 or CVE-2025-9501. If no vulnerability findings are active, run the behavioral queries unscoped to find stealthy or recently patched exploitations.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker is using the Bissa scanner to exploit unauthenticated vulnerabilities in Next.js or WordPress, then harvesting sensitive credentials from .env files and cloud metadata.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional hostnames to narrow the behavioral queries." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "vulnerable_cves": { "from": { "ref": "dfir-report-bissa-scanner", "kind": "article", "observed": "2026-04-22" }, "type": "list[string]", "default": [ "CVE-2025-55182", "CVE-2025-9501" ], "description": "CVE identifiers targeted by the Bissa scanner." }, "env_file_pattern": { "type": "string", "default": "%.env%", "description": "Pattern for environment files containing secrets." }, "batch_zip_pattern": { "from": { "ref": "dfir-report-bissa-scanner", "kind": "article", "observed": "2026-04-22" }, "type": "string", "default": "env-batch-%.zip", "description": "File name pattern for the scanner's staging archives." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/", "name": "Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting" } ], "blind_spots": [ { "id": "post-body-blind-spot", "risk": "Standard HTTP activity logging captures URLs but not POST bodies, making it difficult to differentiate an exploit attempt from a legitimate comment submission.", "stage": "initial-access-mass-exploitation", "question": "What command was injected via the W3 Total Cache comment exploit?", "requires": "full HTTP POST body logging" }, { "id": "no-process-visibility", "risk": "Snapshot-based telemetry may miss the execution of a fast-running credential harvest script if it completes between collection intervals.", "stage": "execution-credential-enumeration-payload", "question": "Did the exploitation payload run as a short-lived process between inventory snapshots?", "requires": "real-time process execution events" } ] }, "name": "Bissa Scanner Mass Exploitation and Credential Harvesting", "description": "This hunt targets the early lifecycle of the Bissa scanner, a modular AI-assisted exploitation platform. It uses a gated flow to first identify internet-facing assets with known vulnerabilities in React Server Components (CVE-2025-55182) or W3 Total Cache (CVE-2025-9501). If such assets exist, it fans out to look for behavioral indicators of post-exploitation: rare processes accessing environment files and the creation of specific ZIP staging archives. An agent triages the results to distinguish automated scanner activity from legitimate local administration, specifically looking for the intersection of vulnerable hosts and suspicious behavior." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting", "index": 1, "title": "Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting", "total": 2 }, "coverage": [ { "stage": "initial-access-mass-exploitation", "steps": [ "vulnerability-lead" ], "status": "covered" }, { "stage": "execution-credential-enumeration-payload", "steps": [ "env-access-prevalence" ], "status": "covered" }, { "stage": "collection-data-staging", "steps": [ "staging-zip-creation" ], "status": "covered" }, { "stage": "c2-telegram-alerting", "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.", "status": "out_of_scope" }, { "stage": "exfiltration-to-filebase-s3", "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.", "status": "out_of_scope" }, { "stage": "credential-abuse-saas-cloud", "reason": "Belongs to another part of the 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting' series.", "status": "out_of_scope" } ], "rationale": "An attacker is using the Bissa scanner to exploit unauthenticated vulnerabilities in Next.js or WordPress, then harvesting sensitive credentials from .env files and cloud metadata.", "blind_spots": [ { "id": "post-body-blind-spot", "risk": "Standard HTTP activity logging captures URLs but not POST bodies, making it difficult to differentiate an exploit attempt from a legitimate comment submission.", "stage": "initial-access-mass-exploitation", "question": "What command was injected via the W3 Total Cache comment exploit?", "requires": "full HTTP POST body logging" }, { "id": "no-process-visibility", "risk": "Snapshot-based telemetry may miss the execution of a fast-running credential harvest script if it completes between collection intervals.", "stage": "execution-credential-enumeration-payload", "question": "Did the exploitation payload run as a short-lived process between inventory snapshots?", "requires": "real-time process execution events" } ], "scoping_notes": "Focus on internet-facing assets reporting CVE-2025-55182 or CVE-2025-9501. If no vulnerability findings are active, run the behavioral queries unscoped to find stealthy or recently patched exploitations.", "beyond_detection": "A single rule might alert on the Bissa ZIP file, but this hunt pivots between the vulnerability posture and behavioral anomalies like rare process interaction with secrets. This distinguishes a focused Bissa exploit from routine administrative actions or generic web noise." } }, { "id": "vulnerability-lead", "type": "query", "label": "Identify vulnerable web assets", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT v.device_uid, d.hostname AS device_hostname, v.cve_uid, v.severity, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (instr(',' || '{{vulnerable_cves}}' || ',', ',' || v.cve_uid || ',') > 0) AND v.status != 'suppressed'", "surface": "hb_vulnerability_finding", "description": "Identify hosts running software versions vulnerable to the Bissa scanner's primary exploit modules and retrieve their hostnames for behavioral correlation.", "expected_signal": "A list of resources currently reporting unpatched vulnerabilities targeted by the scanner, correlated with device hostnames." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify vulnerable web assets", "reads": [ "device_uid", "cve_uid", "severity", "title" ], "source": "hb_vulnerability_finding", "target": "endpoint", "content": "SELECT v.device_uid, d.hostname AS device_hostname, v.cve_uid, v.severity, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (instr(',' || '{{vulnerable_cves}}' || ',', ',' || v.cve_uid || ',') > 0) AND v.status != 'suppressed'", "silence": "not_evidence_of_absence", "expected": "A list of resources currently reporting unpatched vulnerabilities targeted by the scanner, correlated with device hostnames.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "evaluate-lead", "type": "analytic", "label": "Evaluate vulnerability lead", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "vulnerability-lead" ], "objective": "Summarize the vulnerability findings: identify which hosts are vulnerable and identify high-risk internet-facing assets.", "description": "Analyze the scope and severity of the vulnerability findings to decide if behavioral hunting is warranted.", "max_iterations": 3, "expected_signal": "An assessment of which resources represent the highest risk.", "success_criteria": "A concise summary of the exposed attack surface." }, "parents": [ { "id": "vulnerability-lead" } ] }, { "id": "gate", "type": "checkpoint", "label": "Exposure Gate", "config": { "question": "vulnerability-lead.rows > 0", "condition": "vulnerability-lead.rows > 0", "description": "Proceed to behavioral queries only if vulnerable assets are identified in the environment.", "checkpoint_type": "advisory" }, "parents": [ { "id": "evaluate-lead" } ] }, { "id": "env-access-prevalence", "type": "query", "label": "Rare processes accessing environment files", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '{{env_file_pattern}}' OR LOWER(file_path) LIKE '{{env_file_pattern}}') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND process_name IN (SELECT process_name FROM hb_file_activity WHERE (LOWER(file_name) LIKE '{{env_file_pattern}}' OR LOWER(file_path) LIKE '{{env_file_pattern}}') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING COUNT(DISTINCT device_hostname) < 5)", "surface": "hb_file_activity", "description": "Identify specific rows for rare processes reading .env files, which may indicate the scanner's automated payload.", "expected_signal": "Specific rows of process activity touching .env files on few hosts. Legitimate web server processes should be common; one-off scripts are suspicious." }, "parents": [ { "id": "gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare processes accessing environment files", "reads": [ "process_name", "device_hostname", "file_name", "time", "file_path" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '{{env_file_pattern}}' OR LOWER(file_path) LIKE '{{env_file_pattern}}') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND process_name IN (SELECT process_name FROM hb_file_activity WHERE (LOWER(file_name) LIKE '{{env_file_pattern}}' OR LOWER(file_path) LIKE '{{env_file_pattern}}') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING COUNT(DISTINCT device_hostname) < 5)", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "Specific rows of process activity touching .env files on few hosts. Legitimate web server processes should be common; one-off scripts are suspicious.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 5 }, "verified_at": "2026-09-23" } }, { "id": "staging-zip-creation", "type": "query", "label": "Bissa scanner staging archive creation", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '{{batch_zip_pattern}}' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Search for the specific staging archive format used by the Bissa scanner to batch stolen secrets, including process context to distinguish from admins.", "expected_signal": "Creation of env-batch ZIP files. This naming convention is specific to the Bissa scanner workflow and highly indicative of compromise when not performed by a known admin." }, "parents": [ { "id": "gate", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Bissa scanner staging archive creation", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "actor_user_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '{{batch_zip_pattern}}' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "expected": "Creation of env-batch ZIP files. This naming convention is specific to the Bissa scanner workflow and highly indicative of compromise when not performed by a known admin.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "final-triage", "type": "analytic", "label": "Triage investigation findings", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "evaluate-lead", "env-access-prevalence", "staging-zip-creation" ], "objective": "Determine if any host with a vulnerability finding (from evaluate-lead) also shows evidence of rare process access to secrets (env-access-prevalence) or the creation of the Bissa staging archive (staging-zip-creation).", "description": "Correlate vulnerability exposure with behavioral evidence to confirm active exploitation by the Bissa scanner, specifically on the vulnerable hosts identified in the lead.", "max_iterations": 6, "expected_signal": "A verdict for each candidate host identifying it as malicious, suspicious, or benign.", "success_criteria": "A per-host verdict citing specific process and file activity rows, highlighting where the host matches the vulnerable assets list." }, "parents": [ { "id": "env-access-prevalence", "kind": "merge" }, { "id": "staging-zip-creation", "kind": "merge" } ] }, { "id": "route", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage identifies malicious behavior on at least one vulnerable host, specifically where a host identified in the vulnerability-lead step also exhibits indicators from the behavioral queries (rare .env access or Bissa staging archive creation)", "condition": "the triage identifies malicious behavior on at least one vulnerable host, specifically where a host identified in the vulnerability-lead step also exhibits indicators from the behavioral queries (rare .env access or Bissa staging archive creation)", "blind_spot": "no-process-visibility", "confidence": "high", "description": "Direct the hunt toward containment or close-out based on the intersection of vulnerability and behavioral findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Immediately halt the automated harvest and exfiltration process on a confirmed compromised endpoint.", "instructions": "Isolate the host from the network. This stops the Bissa scanner's exfiltration module and preserves the environment for forensic review.", "action_approval": "required" }, "parents": [ { "id": "route", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Manually verify the credentials harvested and initiate rotation.", "instructions": "Review the file and process rows cited by the triage agent. Identify which .env files were accessed and prioritize rotating the contained credentials, especially for AI platforms and cloud providers." }, "parents": [ { "id": "route", "branch": "default" }, { "id": "route", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close-out", "config": { "assignee": "analyst", "description": "Record the findings and ensure vulnerable assets are scheduled for patching even if no exploit was found.", "instructions": "Document the hunt outcome. If vulnerable hosts were identified but no behavioral traces were found, escalate the patching of CVE-2025-55182 and CVE-2025-9501 to the vulnerability management team." }, "parents": [ { "id": "gate", "branch": "on_refutes" }, { "id": "route", "branch": "on_refutes" } ] } ] }