The 7,877-site credential heist that started inside my GCP project

On the night of 16 March 2026 I opened GCP and found three virtual machines I never created. They had been running on the Noverse project for days, scanning the internet and stealing credentials at a scale that still feels unreal when I read my own report.

What was on the machines

Three GCE VMs — fleet-gcp-1-aaefd7, metrics-01-1, metrics-04-1 — created 12–14 March 2026 in us-central1-a, two of them n2-standard-8 (8 vCPU each). They were running a malware toolkit called Bissa:

• A mass .env file scanner that probed thousands of domains for exposed environment files
• 4 parallel Python worker processes per VM, each handling up to 1,536 concurrent connections
• Active exploitation of CVE-2025-55182 (Next.js Server Action RCE) and CVE-2025-9501 (WordPress W3 Total Cache RCE)
• Stolen credentials archived and uploaded in batches to Filebase S3, with real-time alerts pushed to a Telegram bot

The numbers

| Metric | Value |

|---|---|

| Websites compromised | 7,877 |

| Environment files stolen | 11,250 |

| Countries hit | 50+ |

| Active scanning window | ~16 hours |

| Auth secrets (JWT/NextAuth) | 1,791 sites |

| Database credentials | 1,509 sites |

| SSH private keys | 675 sites |

| AI/OpenAI API keys | 511 sites |

| Stripe payment keys | 291 sites |

| AWS credentials | 183 sites |

One victim I remember specifically: a German food-tracking app lost its MySQL creds, NextAuth secrets, PM2 process details, and SSH connection info in one .env pull.

The trail

The toolkit was careful but not invisible:

• C2 server: owmarket.online → Namecheap VPS in Phoenix AZ, with a “Target Dispatcher” panel serving domain lists
• Linked infra: wonomics.com (same IP, active since Oct 2023) and alyrobotictrade.com, a crypto trading platform on the same registrar
• Exfiltration: Filebase S3 bucket bissapromax (45 archives, 16.5 MB), plus Telegram bot @bissapwned_bot feeding stolen creds to @BonJoviGoesHard (“Dr. Tube”)
• Tooling: Docker image hamasoheeao/bissa on Docker Hub, built 16 Mar 2026
• OPSEC tells: separate emails for GCP vs Filebase, S3 buckets wiped between campaigns, no public presence anywhere — but a Telegram group name (“ScansMerguez”) hinted at the operator's region

What I did about it

1. Killed the VMs immediately — 17 March 2026, 00:34 SGT
2. Preserved evidence first — full malware source code (30 Python files), 45 stolen-data archives, the 7,877-victim domain list, GCP audit logs, C2 panel captures, Telegram bot data
3. Wrote the incident report — the one you sent me, with everything: threat actor profile, infra map, malware analysis, impact assessment
4. Reported to the right places — SingCERT (case ref C473784), FBI IC3, Namecheap abuse, Filebase abuse, Telegram abuse, Docker Hub. SingCERT replied advising a police report. I also flagged the crypto platform for potential fraud.

What it taught me

• Monitor your own cloud. Nobody else is going to notice three 8-vCPU VMs appearing in your project. GCP audit logs were the ground truth.
• Containment beats heroics. I didn't try to “fight back” against the C2 — I captured evidence, killed the VMs, and handed the chain to people with subpoena power.
• The boring docs matter. A 6-page report with preserved evidence is what makes abuse reports and law-enforcement referrals actually actionable.
• Exposed .env files are an epidemic. This one operation pulled credentials from nearly 8,000 sites in a single day. If you ship web apps: block /.env, watch your logs, rotate early.

Not the kind of story I expected to add to a portfolio. But it's real work, and it's the kind of thing I now do before anything else: look at what's actually running in your accounts.