Exposed Server Reveals Large-Scale Exploitation Operation

An exposed server recently discovered provided unusual visibility into a large-scale exploitation and data collection operation involving many victims. Artifacts on the server showed that Claude Code and OpenClaw were integrated into the operator's daily workflow, supporting troubleshooting, orchestration, and refinement of the collection pipeline. This AI-assisted workflow enabled the modular Bissa scanner platform to enable a structured process for exploiting targets, reviewing results, validating access, and prioritizing the most valuable victim environments.

The server contained over 13,000 files in 150+ directories related to exploit, victim data staging, credential harvesting, access validation, and operator workflow management. The contents showed that this infrastructure was not simply used to store opportunistically stolen data but supported an organized operation aimed at gaining large-scale access and operationalizing the most valuable results.

Operation Details

The artifacts on the server showed that React2Shell (CVE-2025-55182) was central to the operation. The workflow appeared capable of scanning millions of exposed targets on the Internet, with logs indicating over 900 confirmed compromises. The data collected included large volumes of environment files and credentials spanning AI platforms, cloud services, payment platforms, databases, and messaging systems. Additional scripts and local tools suggested the operator was actively testing and sorting this access to determine which victim credentials, accounts, and datasets were most useful for subsequent activities.

The exposed server also provided rare insights into the infrastructure and operator behind the activity. Telegram alert artifacts hardcoded within the Bissa scanner harness linked the operation to a single operator, publicly identifiable with the Telegram username @BonJoviGoesHard and the display name “Dr. Tube”. The operator appears to manage at least two dedicated bots, @bissapwnedbot for scanner alerts and @bissascanbot within the AI control subsystem.

Sensitive Data and Victims

The credential harvesting spanned every level of modern SaaS, with AI platforms as the single largest category. Downloaded credentials included keys related to platforms such as Anthropic, Google, OpenAI, Mistral, OpenRouter, Groq, Replicate, DeepSeek, HuggingFace, AWS, Cloudflare, Azure, Google Cloud / Firebase, DigitalOcean, Alchemy, Resend, Telegram, SendGrid, Twilio, Vonage, Postmark, Stripe, PayPal, Shopify, Square, Sentry, Segment, Intercom, Mixpanel, Plaid, Supabase, MongoDB, GitHub, Auth0 / Okta, Clerk, RevenueCat, Mapbox, Fireblocks, and Slack.

Among the identified victims, one victim, referred to as Victim A, was generalized as a mid-sized financial consulting and tax resolution firm. Research found direct evidence of exploitation for this environment and a separate bundle labeled as a data sample present on the same host. The staged dataset included Plaid tokens, banking credentials, and other sensitive information.

• Immediate revocation of all compromised credentials and generation of new access keys.
• Implementation of multi-factor authentication for all critical accounts.
• Conducting a comprehensive audit of account permissions to identify and remove unnecessary access.
• Continuous monitoring for suspicious activities and implementation of advanced detection solutions.
• Transparent communication with stakeholders, including customers and regulatory authorities, if necessary.

Additionally, victims should consider collaborating with cybersecurity experts to conduct an in-depth analysis of their infrastructures and identify any remaining vulnerabilities. Sharing information with other affected organizations can also provide valuable insights into effectively addressing this threat.