---
analysis: A single rule might alert on the Bissa ZIP file, but this hunt pivots between
  the vulnerability posture and behavioral anomalies like rare process interaction
  with secrets. This distinguishes a focused Bissa exploit from routine administrative
  actions or generic web noise.
blind_spots:
- id: post-body-blind-spot
  question: What command was injected via the W3 Total Cache comment exploit?
  requires: full HTTP POST body logging
  risk: Standard HTTP activity logging captures URLs but not POST bodies, making it
    difficult to differentiate an exploit attempt from a legitimate comment submission.
  stage: initial-access-mass-exploitation
- id: no-process-visibility
  question: Did the exploitation payload run as a short-lived process between inventory
    snapshots?
  requires: real-time process execution events
  risk: Snapshot-based telemetry may miss the execution of a fast-running credential
    harvest script if it completes between collection intervals.
  stage: execution-credential-enumeration-payload
coverage:
- stage: initial-access-mass-exploitation
  status: covered
  steps:
  - vulnerability-lead
- stage: execution-credential-enumeration-payload
  status: covered
  steps:
  - env-access-prevalence
- stage: collection-data-staging
  status: covered
  steps:
  - staging-zip-creation
- reason: 'Belongs to another part of the ''Bissa Scanner Exposed: AI-Assisted Mass
    Exploitation and Credential Harvesting'' series.'
  stage: c2-telegram-alerting
  status: out_of_scope
- reason: 'Belongs to another part of the ''Bissa Scanner Exposed: AI-Assisted Mass
    Exploitation and Credential Harvesting'' series.'
  stage: exfiltration-to-filebase-s3
  status: out_of_scope
- reason: 'Belongs to another part of the ''Bissa Scanner Exposed: AI-Assisted Mass
    Exploitation and Credential Harvesting'' series.'
  stage: credential-abuse-saas-cloud
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: The Bissa scanner operation has successfully compromised over 900
    organizations. Confirming the absence of automated harvest behavior on vulnerable
    web servers provides significant risk reduction.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An attacker is using the Bissa scanner to exploit unauthenticated vulnerabilities
  in Next.js or WordPress, then harvesting sensitive credentials from .env files and
  cloud metadata.
labels:
- hunt
- attack.t1190
- attack.t1059.004
- attack.t1083
- attack.t1560.001
name: Bissa Scanner Mass Exploitation and Credential Harvesting
parameters:
  batch_zip_pattern:
    default: env-batch-%.zip
    description: File name pattern for the scanner's staging archives.
    from:
      kind: article
      observed: '2026-04-22'
      ref: dfir-report-bissa-scanner
    type: string
  env_file_pattern:
    default: '%.env%'
    description: Pattern for environment files containing secrets.
    type: string
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional hostnames to narrow the behavioral queries.
    type: list[host]
  vulnerable_cves:
    default:
    - CVE-2025-55182
    - CVE-2025-9501
    description: CVE identifiers targeted by the Bissa scanner.
    from:
      kind: article
      observed: '2026-04-22'
      ref: dfir-report-bissa-scanner
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on internet-facing assets reporting CVE-2025-55182 or CVE-2025-9501.
  If no vulnerability findings are active, run the behavioral queries unscoped to
  find stealthy or recently patched exploitations.
references:
- name: 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting'
  url: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/
related:
- hunt: bissa-scanner-c2-telegram
  reason: This hunt focuses on endpoint behavior; the Telegram hunt focuses on the
    C2 alerting channel.
  relation: out-of-scope-alternative
- hunt: bissa-scanner-exfiltration-filebase
  reason: This hunt identifies staging; the exfiltration hunt identifies the subsequent
    move to S3 storage.
  relation: follows
scenario:
  stages:
  - name: Mass Vulnerability Exploitation
    observables:
    - CVE-2025-55182
    - CVE-2025-9501
    - React Server Function endpoints
    - W3 Total Cache _parse_dynamic_mfunc payload
    - denemekulubum.com.tr/acquirer/
    - wiprz.com/acquirer/
    - cs2.ip.thc.org
    slug: initial-access-mass-exploitation
    tactic: initial-access
    techniques:
    - T1190
  - name: Local Credential and Metadata Enumeration
    observables:
    - .env file enumeration
    - Kubernetes service account context retrieval
    - Cloud metadata service (IMDS) access
    - Local database and Redis credential search
    - Cryptocurrency wallet search
    slug: execution-credential-enumeration-payload
    tactic: execution
    techniques:
    - T1059.004
    - T1083
  - name: Telegram Bot Command and Control
    observables:
    - api.telegram.org
    - '@bissapwned_bot'
    - '@bissa_scan_bot'
    - Bot ID 8798206332
    - Chat ID 1609309278
    slug: c2-telegram-alerting
    tactic: command-and-control
    techniques:
    - T1102.002
    - T1071.001
  - name: Archive Staging of Environment Files
    observables:
    - results/ directory monitoring
    - env-batch-*.zip
    - Batching of .env files into ZIP archives
    slug: collection-data-staging
    tactic: collection
    techniques:
    - T1560.001
  - name: Exfiltration to Filebase S3
    observables:
    - s3.filebase.com
    - 'bucket: bissapromax'
    - 'prefix: archives/'
    slug: exfiltration-to-filebase-s3
    tactic: exfiltration
    techniques:
    - T1567.002
  - name: Post-Compromise Credential Abuse
    observables:
    - Anthropic API keys
    - AWS access keys
    - Okta/Auth0 tokens
    - Stripe/PayPal tokens
    - GitHub personal access tokens
    - Slack integration tokens
    - Oracle Fusion REST export activity
    slug: credential-abuse-saas-cloud
    tactic: credential-access
    techniques:
    - T1078.004
    - T1528
  summary: The Bissa Scanner campaign involves large-scale, automated exploitation
    of React Server Components (CVE-2025-55182) and WordPress (CVE-2025-9501) to harvest
    secrets at scale. The operator, 'Dr. Tube', utilizes AI-assisted workflows via
    Claude Code and OpenClaw to triage stolen data and automate alerting through Telegram
    bots, eventually exfiltrating credentials to S3-compatible Filebase storage.
series:
  index: 1
  slug: bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting
  title: 'Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting'
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# Bissa Scanner Mass Exploitation and Credential Harvesting

This hunt targets the early lifecycle of the Bissa scanner, a modular AI-assisted exploitation platform. It uses a gated flow to first identify internet-facing assets with known vulnerabilities in React Server Components (CVE-2025-55182) or W3 Total Cache (CVE-2025-9501). If such assets exist, it fans out to look for behavioral indicators of post-exploitation: rare processes accessing environment files and the creation of specific ZIP staging archives. An agent triages the results to distinguish automated scanner activity from legitimate local administration, specifically looking for the intersection of vulnerable hosts and suspicious behavior.

## vulnerability-lead
<!-- Identify vulnerable web assets -->
Identify hosts running software versions vulnerable to the Bissa scanner's primary exploit modules and retrieve their hostnames for behavioral correlation.

```sqlite target=endpoint role=scoping params=(vulnerable_cves=vulnerable_cves)
~~~yaml
expected: A list of resources currently reporting unpatched vulnerabilities targeted
  by the scanner, correlated with device hostnames.
reads:
- device_uid
- cve_uid
- severity
- title
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT v.device_uid, d.hostname AS device_hostname, v.cve_uid, v.severity, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE (instr(',' || '{{vulnerable_cves}}' || ',', ',' || v.cve_uid || ',') > 0) AND v.status != 'suppressed'
```

## evaluate-lead
<!-- Evaluate vulnerability lead -->
```agent target=hunter
cite: required
context:
- vulnerability-lead
max_iterations: 3
objective: 'Summarize the vulnerability findings: identify which hosts are vulnerable
  and identify high-risk internet-facing assets.'
success_criteria: A concise summary of the exposed attack surface.
tools:
- endpoint
```

## gate
<!-- Exposure Gate -->
if: `vulnerability-lead.rows > 0`
then: → post-exploit-fanout
else: → close-out

## post-exploit-fanout
<!-- Post-Exploitation Fan-out -->
parallel:
- → env-access-prevalence
- → staging-zip-creation
join: → final-triage

## env-access-prevalence
<!-- Rare processes accessing environment files -->
Identify specific rows for rare processes reading .env files, which may indicate the scanner's automated payload.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, env_file_pattern=env_file_pattern, scope_hosts=scope_hosts)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: Specific rows of process activity touching .env files on few hosts. Legitimate
  web server processes should be common; one-off scripts are suspicious.
prevalence:
  by: device_hostname
  key:
  - process_name
  rare_below: 5
reads:
- process_name
- device_hostname
- file_name
- time
- file_path
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT device_hostname, process_name, file_path, time FROM hb_file_activity WHERE (LOWER(file_name) LIKE '{{env_file_pattern}}' OR LOWER(file_path) LIKE '{{env_file_pattern}}') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND process_name IN (SELECT process_name FROM hb_file_activity WHERE (LOWER(file_name) LIKE '{{env_file_pattern}}' OR LOWER(file_path) LIKE '{{env_file_pattern}}') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING COUNT(DISTINCT device_hostname) < 5)
```

## staging-zip-creation
<!-- Bissa scanner staging archive creation -->
Search for the specific staging archive format used by the Bissa scanner to batch stolen secrets, including process context to distinguish from admins.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, batch_zip_pattern=batch_zip_pattern, scope_hosts=scope_hosts)
~~~yaml
expected: Creation of env-batch ZIP files. This naming convention is specific to the
  Bissa scanner workflow and highly indicative of compromise when not performed by
  a known admin.
reads:
- device_hostname
- file_name
- file_path
- process_name
- actor_user_name
- time
silence: evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-09-23'
~~~
SELECT device_hostname, file_name, file_path, process_name, actor_user_name, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '{{batch_zip_pattern}}' AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)
```

## final-triage
<!-- Triage investigation findings -->
```agent target=hunter
cite: required
context:
- evaluate-lead
- env-access-prevalence
- staging-zip-creation
max_iterations: 6
objective: Determine if any host with a vulnerability finding (from evaluate-lead)
  also shows evidence of rare process access to secrets (env-access-prevalence) or
  the creation of the Bissa staging archive (staging-zip-creation).
success_criteria: A per-host verdict citing specific process and file activity rows,
  highlighting where the host matches the vulnerable assets list.
tools:
- endpoint
```

## route
<!-- Route on verdict -->
if~: "the triage identifies malicious behavior on at least one vulnerable host, specifically where a host identified in the vulnerability-lead step also exhibits indicators from the behavioral queries (rare .env access or Bissa staging archive creation)" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: no-process-visibility)
else: → close-out

## isolate-host
<!-- Isolate compromised host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the host from the network. This stops the Bissa scanner's exfiltration module and preserves the environment for forensic review.
```
→ analyst-review

## analyst-review
<!-- Analyst forensic review -->
```manual target=analyst
Review the file and process rows cited by the triage agent. Identify which .env files were accessed and prioritize rotating the contained credentials, especially for AI platforms and cloud providers.
```
→ end

## close-out
<!-- Hunt close-out -->
```manual target=analyst
Document the hunt outcome. If vulnerable hosts were identified but no behavioral traces were found, escalate the patching of CVE-2025-55182 and CVE-2025-9501 to the vulnerability management team.
```
→ end