Bissa Scanner Mass-Exploits React2Shell With AI Help
An exposed server revealed the AI-assisted Bissa scanner operation, which exploited CVE-2025-55182 across 900+ organizations to harvest secrets from tens of thousands of .env files.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-55182 as exploited in the wild.
The DFIR Report identified an exposed operator server hosting the infrastructure behind Bissa scanner, a modular exploitation and credential-harvesting platform. The operator used Claude Code and OpenClaw as an AI-assisted harness to build, troubleshoot, and orchestrate the scanner, which conducted internet-scale scanning for CVE-2025-55182 (React2Shell, a Next.js flaw) and confirmed over 900 successful compromises. A secondary module targeted CVE-2025-9501, an unauthenticated command injection in the W3 Total Cache WordPress plugin, though no evidence of successful exploitation via that module was found.
Post-compromise, the operator harvested .env files and secrets spanning AI providers, cloud services, payment platforms, databases, and messaging systems, then triaged and validated access to prioritize high-value targets in financial services, cryptocurrency, and retail. Victim-specific data clusters included a tax/financial advisory firm (Plaid tokens, IRS transcripts, SSN/DOB data), a digital-asset/payments enterprise (Oracle Fusion export data), and a payroll/stablecoin platform (Fireblocks, HRIS data). Harvested .env archives were exfiltrated to an S3-compatible Filebase bucket, with over 30,000 distinct filenames and 65,000+ archived entries collected between April 10–21, 2026.
The investigation also exposed the operator's Telegram-based C2 and alerting infrastructure, tying the activity to a single individual publicly identifiable via the handle @BonJoviGoesHard (display name 'Dr. Tube'), who ran at least two Telegram bots for scanner alerting and AI-control. The report indicates a disciplined, long-running, repeatable operation converting mass internet scanning into validated, high-value compromises, with coordinated disclosures to affected organizations underway and law enforcement engaged.
Mentioned in this report
Detection guidance
Automated Scanning and Exploitation via Command Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects scripted command execution patterns consistent with mass vulnerability scanning and exploitation automation, including repeated curl/wget requests to potential vulnerable endpoints with exploit payloads or probing patterns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Automated Scanning and Exploitation via Command Interpreter
description: Detects process execution indicative of mass internet-scale scanning
for vulnerabilities (CVE-2025-55182, CVE-2025-9501), including rapid-fire curl/wget
invocations with payload injection patterns, Next.js framework probes, or WordPress
plugin targeting. Generalises on parent process (shell/Python/Node) spawning scanner
binaries in loops or via interpreted scripts, not specific IPs or payloads.
tags:
- attack.execution
- attack.t1059
- attack.t1595
logsource:
category: process_creation
product: windows
detection:
selection_scanner_parent:
ParentImage|endswith:
- \cmd.exe
- \powershell.exe
- \python.exe
- \node.exe
selection_scanner_child:
Image|endswith:
- \curl.exe
- \wget.exe
selection_exploit_pattern:
CommandLine|contains:
- _next/data/
- wp-content/plugins/w3-total-cache
- __webpack_require__
- rpc.json
filter_legitimate_admin:
CommandLine|contains: 'User-Agent: Mozilla'
condition: (selection_scanner_parent and selection_scanner_child) and selection_exploit_pattern
and not filter_legitimate_admin
falsepositives:
- Legitimate security scanners or penetration testing frameworks spawning curl/wget
in batch
- IT operations running diagnostic scripts that probe web services
level: high
id: 318416a6-b4c4-57c4-ab85-828aac978ea5
status: experimental
author: Vorant
Extraction and Staging of Environment Configuration Files
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects credential harvesting via enumeration and copying of .env files, configuration files, and secrets from application directories, typically preceding exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Extraction and Staging of Environment Configuration Files
description: Detects processes copying, reading, or archiving .env files, secrets
configuration files, and credential stores (typical post-compromise behaviour targeting
database credentials, API keys, cloud provider tokens). Generalises on file pattern
matching and copy/archive verbs, not specific victim paths or secret values.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: windows
detection:
selection_copy_tool:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \tar.exe
- \7z.exe
- \zip.exe
selection_env_target:
CommandLine|contains:
- .env
- secrets/
- config/
- .config
selection_copy_action:
CommandLine|contains:
- 'copy '
- 'move '
- '-a '
- '-r '
- 'tar '
- 'zip '
- -cfz
filter_npm_install:
CommandLine|contains: node_modules
condition: selection_copy_tool and selection_env_target and selection_copy_action
and not filter_npm_install
falsepositives:
- Legitimate CI/CD pipelines backing up environment configurations
- Software deployment tools archiving config during updates
level: high
id: 5f7f500c-8db5-5bb8-8794-024e89fc477f
status: experimental
author: Vorant
Exfiltration to S3-Compatible Cloud Storage
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connections uploading archives or bulk data to S3-compatible cloud storage endpoints (Filebase, AWS S3 clones), typical post-compromise exfiltration of harvested credentials and victim data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exfiltration to S3-Compatible Cloud Storage
description: Detects process establishing outbound connections to S3-compatible storage
services (Filebase, DigitalOcean Spaces, AWS S3 endpoints) using aws-cli, boto3,
curl, or similar tools with PUT/POST methods. Generalises on S3 API endpoint patterns
and upload verbs, not specific bucket names or IPs.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_s3_tool:
Image|endswith:
- \aws.exe
- \curl.exe
- \python.exe
selection_s3_endpoint:
CommandLine|contains:
- .s3.
- filebase
- s3-compatible
- .digitaloceanspaces.
- s3api
selection_upload_action:
CommandLine|contains:
- put-object
- upload
- PUT
- POST
condition: selection_s3_tool and selection_s3_endpoint and selection_upload_action
falsepositives:
- Legitimate backup and disaster-recovery processes uploading to S3
- CI/CD artifact storage and deployment pipelines
level: medium
id: 29d15ef5-3ed8-5c3f-9bc4-ecd8d30317ee
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs