{"type":"bundle","id":"bundle--4f780226-d1d8-5c28-8ef3-bf6581f38cc0","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--89fa8f83-1633-5773-b009-cfecb3f29f97","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.118079Z","modified":"2026-08-29T13:15:02.118079Z","name":"SIGMA: Bissa Scanner AI-Assisted Vulnerability Probing","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'Bissa Scanner AI-Assisted Vulnerability Probing']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.118079Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--be43ec1f-ddb0-508a-a234-fcad8d428427","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.118079Z","modified":"2026-08-29T13:15:02.118079Z","name":"YARA: TOOL_SCANNER_Bissa_Agent","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'TOOL_SCANNER_Bissa_Agent']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.118079Z","confidence":95},{"type":"report","spec_version":"2.1","id":"report--86c75f39-5072-5428-a34d-5dc2e57e0c6f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.118079Z","modified":"2026-10-30T15:09:10.778093Z","name":"Analysis of Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting","description":"Technical threat analysis derived from intelligence published at https://thedfirreport.com/2026/04/22/bissa-scanner-exposed-ai-assisted-mass-exploitation-and-credential-harvesting/.\n\nBissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting Key Takeaways We identified an exposed server that provided unusual visibility into a large-scale, multi-victim exploitation and collection operation. Artifacts on the host showed that Claude Code and OpenClaw were embedded in the operator’s day-to-day workflow, supporting troubleshooting, orchestration, and refinement of the collection pipeline. This AI-assisted workflow resulted in the modular platform Bissa scanner […] The post Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting appeared first on The DFIR Report.","published":"2026-08-29T13:15:02.118079Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--89fa8f83-1633-5773-b009-cfecb3f29f97","indicator--be43ec1f-ddb0-508a-a234-fcad8d428427"],"confidence":95}]}