Bissa Scanner Mass-Exploits React2Shell With AI Help

An exposed server revealed the AI-assisted Bissa scanner operation, which exploited CVE-2025-55182 across 900+ organizations to harvest secrets from tens of thousands of .env files.

The DFIR Report identified an exposed operator server hosting the infrastructure behind Bissa scanner, a modular exploitation and credential-harvesting platform. The operator used Claude Code and OpenClaw as an AI-assisted harness to build, troubleshoot, and orchestrate the scanner, which conducted internet-scale scanning for CVE-2025-55182 (React2Shell, a Next.js flaw) and confirmed over 900 successful compromises. A secondary module targeted CVE-2025-9501, an unauthenticated command injection in the W3 Total Cache WordPress plugin, though no evidence of successful exploitation via that module was found.

Post-compromise, the operator harvested .env files and secrets spanning AI providers, cloud services, payment platforms, databases, and messaging systems, then triaged and validated access to prioritize high-value targets in financial services, cryptocurrency, and retail. Victim-specific data clusters included a tax/financial advisory firm (Plaid tokens, IRS transcripts, SSN/DOB data), a digital-asset/payments enterprise (Oracle Fusion export data), and a payroll/stablecoin platform (Fireblocks, HRIS data). Harvested .env archives were exfiltrated to an S3-compatible Filebase bucket, with over 30,000 distinct filenames and 65,000+ archived entries collected between April 10–21, 2026.

The investigation also exposed the operator's Telegram-based C2 and alerting infrastructure, tying the activity to a single individual publicly identifiable via the handle @BonJoviGoesHard (display name 'Dr. Tube'), who ran at least two Telegram bots for scanner alerting and AI-control. The report indicates a disciplined, long-running, repeatable operation converting mass internet scanning into validated, high-value compromises, with coordinated disclosures to affected organizations underway and law enforcement engaged.

title: Automated Scanning and Exploitation via Command Interpreter
description: Detects process execution indicative of mass internet-scale scanning
  for vulnerabilities (CVE-2025-55182, CVE-2025-9501), including rapid-fire curl/wget
  invocations with payload injection patterns, Next.js framework probes, or WordPress
  plugin targeting. Generalises on parent process (shell/Python/Node) spawning scanner
  binaries in loops or via interpreted scripts, not specific IPs or payloads.
tags:
- attack.execution
- attack.t1059
- attack.t1595
logsource:
  category: process_creation
  product: windows
detection:
  selection_scanner_parent:
    ParentImage|endswith:
    - \cmd.exe
    - \powershell.exe
    - \python.exe
    - \node.exe
  selection_scanner_child:
    Image|endswith:
    - \curl.exe
    - \wget.exe
  selection_exploit_pattern:
    CommandLine|contains:
    - _next/data/
    - wp-content/plugins/w3-total-cache
    - __webpack_require__
    - rpc.json
  filter_legitimate_admin:
    CommandLine|contains: 'User-Agent: Mozilla'
  condition: (selection_scanner_parent and selection_scanner_child) and selection_exploit_pattern
    and not filter_legitimate_admin
falsepositives:
- Legitimate security scanners or penetration testing frameworks spawning curl/wget
  in batch
- IT operations running diagnostic scripts that probe web services
level: high
id: 318416a6-b4c4-57c4-ab85-828aac978ea5
status: experimental
author: Vorant

title: Extraction and Staging of Environment Configuration Files
description: Detects processes copying, reading, or archiving .env files, secrets
  configuration files, and credential stores (typical post-compromise behaviour targeting
  database credentials, API keys, cloud provider tokens). Generalises on file pattern
  matching and copy/archive verbs, not specific victim paths or secret values.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_copy_tool:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \tar.exe
    - \7z.exe
    - \zip.exe
  selection_env_target:
    CommandLine|contains:
    - .env
    - secrets/
    - config/
    - .config
  selection_copy_action:
    CommandLine|contains:
    - 'copy '
    - 'move '
    - '-a '
    - '-r '
    - 'tar '
    - 'zip '
    - -cfz
  filter_npm_install:
    CommandLine|contains: node_modules
  condition: selection_copy_tool and selection_env_target and selection_copy_action
    and not filter_npm_install
falsepositives:
- Legitimate CI/CD pipelines backing up environment configurations
- Software deployment tools archiving config during updates
level: high
id: 5f7f500c-8db5-5bb8-8794-024e89fc477f
status: experimental
author: Vorant

title: Exfiltration to S3-Compatible Cloud Storage
description: Detects process establishing outbound connections to S3-compatible storage
  services (Filebase, DigitalOcean Spaces, AWS S3 endpoints) using aws-cli, boto3,
  curl, or similar tools with PUT/POST methods. Generalises on S3 API endpoint patterns
  and upload verbs, not specific bucket names or IPs.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_s3_tool:
    Image|endswith:
    - \aws.exe
    - \curl.exe
    - \python.exe
  selection_s3_endpoint:
    CommandLine|contains:
    - .s3.
    - filebase
    - s3-compatible
    - .digitaloceanspaces.
    - s3api
  selection_upload_action:
    CommandLine|contains:
    - put-object
    - upload
    - PUT
    - POST
  condition: selection_s3_tool and selection_s3_endpoint and selection_upload_action
falsepositives:
- Legitimate backup and disaster-recovery processes uploading to S3
- CI/CD artifact storage and deployment pipelines
level: medium
id: 29d15ef5-3ed8-5c3f-9bc4-ecd8d30317ee
status: experimental
author: Vorant

Source reporting: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting