# Bissa Scanner — AI-Assisted Mass Exploitation of CVE-2025-55182 (React Server Components RCE) and CVE-2025-9501 (W3 Total Cache)

> AI-orchestrated mass-exploitation and credential-harvesting campaign operated by Telegram handle @BonJoviGoesHard (Dr. Tube). The scanner abuses CVE-2025-55182 (React Server Components / Next.js pre-auth RCE, CVSS 10.0) and CVE-2025-9501 (W3 Total Cache unauthenticated command injection, CVSS 9.0) at internet scale, yielding 900+ confirmed React2Shell compromises and 30,000+ exfiltrated .env files (65,000+ archived entries) staged in three Filebase S3 buckets — bissa, bissa2, bissapromax. Stolen secrets span AI providers (Anthropic, OpenAI, Google, Mistral, OpenRouter, Groq, Replicate, DeepSeek, HuggingFace), all major clouds (AWS, GCP/Firebase, Azure, Cloudflare, DigitalOcean, Alchemy), payments (Stripe, PayPal, Shopify, Square), banking (Plaid), crypto custody (Fireblocks), auth (Auth0/Okta, Clerk), and source control (GitHub). The operator embedded Claude Code (claude-sonnet-4-6) and OpenClaw into day-to-day scanner refinement and exploit triage.

- **Published:** 2026-04-27T12:00:00Z
- **Last reviewed:** 2026-04-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0428
- **ID:** TL-2026-0428
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Actor:** BonJoviGoesHard
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182, CVE-2025-9501

## Description

Bissa Scanner is an active, lone-operator mass-exploitation framework that weaponizes CVE-2025-55182 — a CVSS 10.0 pre-auth remote code execution flaw in React Server Components (RSC) bundlers and routing infrastructure used by Next.js, Remix, and other RSC-aware frameworks — together with CVE-2025-9501, a CVSS 9.0 unauthenticated command-injection issue in WordPress plugin W3 Total Cache (versions <2.8.13). The campaign is run by Telegram user @BonJoviGoesHard (display name ''Dr. Tube'', User ID 1609309278) and supported by an automated bot army centered on @bissapwned_bot (Bot ID 8798206332) for victim alerting and @bissa_scan_bot for AI-control orchestration.

The scanner ingests target lists from acquirer endpoints — most recently denemekulubum.com.tr/acquirer/ (formerly wiprz.com/acquirer/) and target feeds distributed via cs2.ip.thc.org — and assigns work via lease files keyed to exploit modules (e.g., cve_2025_55182). After RCE is achieved, payloads enumerate .env files, cloud metadata services (AWS IMDS, GCP metadata, Azure IMDS), Kubernetes service-account tokens, credential stores, database/Redis access, and cryptocurrency wallets. Harvested .env files land in a results/ directory on the operator''s scanner hosts where a watcher batches them into env-batch-*.zip archives and uploads to Filebase (s3.filebase.com) under the bissa, bissa2, and bissapromax buckets. Bissa was first stood up September 2025; bissa2 in November 2025; bissapromax in December 2025 — the latter remains the active live archive. Telegram alerts deliver per-hit notifications to chat ID 1609309278.

Forensic recovery from the exposed buckets surfaced 13,000+ files across 150+ directories, 400+ raw env-batch-*.zip objects, 30,000+ distinct .env filenames, and 65,000+ archived file entries. The intensive harvesting window observed ran April 10–21, 2026, immediately preceding The DFIR Report''s public exposure on 2026-04-22. Confirmed victim profiles include: a mid-sized US tax-resolution and financial-advisory firm (Plaid tokens, linked bank accounts, IRS transcripts, ACH records, Twilio call logs, Salesforce contacts, SSN/DOB case data); a large digital-asset and enterprise-finance company (authenticated Oracle Fusion REST exports — suppliers, invoices, POs, payments, bank accounts); and a mid-sized payroll/HR/stablecoin payments platform (payroll records, settlement data, Fireblocks integration material, HRIS data).

The most novel element is the operator''s integration of large-language-model tooling into the offensive workflow. Claude Code (claude-sonnet-4-6) was used for scanner code review, troubleshooting, and documentation, while OpenClaw provided a local AI-control surface with a websocket gateway and browser automation layer for exploit triage. A helper script, claude_env_fix.sh, was used to repair malformed .env captures before secret-harvest parsing. This places Bissa in a small but growing class of offensive operations using consumer LLM coding agents as productivity multipliers for scanner development and triage.

Downstream blast radius is severe: harvested credentials enable full takeover of the victim''s AWS, GCP, Azure, Cloudflare, Stripe, PayPal, Auth0/Okta, Clerk, Supabase, MongoDB, Plaid, Fireblocks, and GitHub tenants — meaning the campaign functions as an enabler for ransomware, BEC, payment fraud, crypto theft, and supply-chain compromise via stolen GitHub tokens. CVE-2025-55182 was added to the CISA Known Exploited Vulnerabilities catalog on 2025-12-05 with a 2025-12-19 federal remediation deadline; W3 Total Cache CVE-2025-9501 has been observed under active exploitation since the v2.8.13 patch in early 2026. Defenders should patch RSC-using applications to the React 19.x security release line and W3 Total Cache to >=2.8.13, block egress to s3.filebase.com from production tenants where unjustified, hunt for env-batch-*.zip and claude_env_fix.sh artifacts on web-tier hosts, rotate every secret class listed in this advisory, and treat any Plaid/Stripe/Fireblocks key recovered from a compromised .env as already-burned.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592 Gather Victim Host Information
- T1583.006 Acquire Infrastructure: Web Services
- T1587.004 Develop Capabilities: Exploits
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1078.004 Valid Accounts: Cloud Accounts
- T1078 Valid Accounts
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1552.007 Unsecured Credentials: Container API
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1613 Container and Resource Discovery
- T1005 Data from Local System
- T1560.001 Archive Collected Data: Archive via Utility
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1537 Transfer Data to Cloud Account
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [The DFIR Report — Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting](https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/)
- [NVD — CVE-2025-55182](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [React Blog — Critical Security Vulnerability in React Server Components](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)
- [Facebook Security Advisory — CVE-2025-55182](https://www.facebook.com/security/advisories/cve-2025-55182)
- [SOCPrime — Bissa Scanner Automates Exploitation and Credential Theft](https://socprime.com/blog/bissa-scanner-automates-exploitation-and-credential-theft/)
- [CISA KEV Catalog — CVE-2025-55182](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD — CVE-2025-9501 (W3 Total Cache)](https://nvd.nist.gov/vuln/detail/CVE-2025-9501)
- [Filebase Documentation — S3-Compatible Object Storage](https://docs.filebase.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0428