비싸 스캐너 노출: AI 지원 대규모 악용 및 자격 증명 수집

“graph TB %% Class definitions classDef technique fill:#ffcc99 classDef tool fill:#cccccc classDef action fill:#99ccff classDef operator fill:#ff9900 %% Nodes tool_bissa_scanner[“Tool – Name: Bissa scanner
Purpose: Perform massive active scanning using target feeds”] class tool_bissa_scanner tool tech_T1595_002[“Technique – T1595.002 Active Scanning: Vulnerability Scanning
Description: Scans Internet‑facing hosts to find vulnerable services”] class tech_T1595_002 technique tech_T1190[“Technique – T1190 Exploit Public‑Facing Application
Description: Exploits vulnerable web applications to gain initial access”] class tech_T1190 technique tool_react2shell[“Tool – Name: React2Shell (CVE‑2025‑55182)
Function: Provides remote code execution via crafted React payload”] class tool_react2shell tool tech_T1210[“Technique – T1210 Exploitation of Remote Services
Description: Executes payload on remote services to obtain code execution”] class tech_T1210 technique tech_T1211[“Technique – T1211 Exploitation for Defense Evasion
Description: Uses vulnerabilities to bypass defenses and stay hidden”] class tech_T1211 technique tech_T1552_001[“Technique – T1552.001 Unsecured Credentials: Credentials In Files
Description: Harvests credentials stored in configuration files such as .env”] class tech_T1552_001 technique tech_T1119[“Technique – T1119 Automated Collection
Description: Automates validation, prioritization, and batching of collected data for exfiltration”] class tech_T1119 technique tech_T1102_002[“Technique – T1102.002 Web Service: Bidirectional Communication
Description: Uses web services (Telegram bots) to exchange commands and data”] class tech_T1102_002 technique tool_telegram_bot[“Tool – Name: Telegram bots @bissapwned_bot, @bissa_scan_bot
Purpose: Command‑and‑control channel”] class tool_telegram_bot tool tech_T1567_002[“Technique – T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Description: Uploads stolen archives to cloud storage via web service”] class tech_T1567_002 technique tool_filebase_bucket[“Tool – Name: Filebase S3‑compatible bucket (bissapromax)
Purpose: Stores exfiltrated credential archives”] class tool_filebase_bucket tool tech_T1537[“Technique – T1537 Transfer Data to Cloud Account
Description: Moves data to an attacker‑controlled cloud account for later retrieval”] class tech_T1537 technique tech_T1068[“Technique – T1068 Exploitation for Privilege Escalation
Description: Leverages harvested credentials to gain higher privileges and lateral movement”] class tech_T1068 technique %% Connections tool_bissa_scanner –>|performs| tech_T1595_002 tech_T1595_002 –>|identifies vulnerable services| tech_T1190 tech_T1190 –>|uses| tool_react2shell tool_react2shell –>|delivers payload to| tech_T1210 tech_T1210 –>|enables| tech_T1211 tech_T1211 –>|allows| tech_T1552_001 tech_T1552_001 –>|feeds into| tech_T1119 tech_T1119 –>|sends data via| tech_T1102_002 tech_T1102_002 –>|implemented by| tool_telegram_bot tech_T1102_002 –>|exfiltrates to| tech_T1567_002 tech_T1567_002 –>|stores in| tool_filebase_bucket tool_filebase_bucket –>|enables| tech_T1537 tech_T1537 –>|supports| tech_T1068 “

공격 흐름