An AI pentest platform forked from ARTEX, self-hosted on Alibaba Cloud, compromised an IIS web application, extracted AWS credentials from web.config, and made hundreds of API calls across 18 services in approximately 30 minutes.
Most returned AccessDenied. One returned a production secret.
Why the denial count is the wrong metric
An agent enumerating a permission boundary doesn’t stop after a few failures — it has no reason to. Each AccessDenied narrows the boundary. The burst isn’t a failed intrusion; it’s the search phase of a successful one.
What actually works for detection
Alert on successful GetSecretValue from hosting-provider ASNs that have never touched the account
Hunt for a single source IP cycling multiple IAM users or assumed roles in a short window
Tie IIS web-shell activity (w3wp.exe spawning cmd.exe/powershell.exe) to subsequent AWS CloudTrail activity — the two halves of this intrusion are minutes apart, not days
Remediation note
Deleting a leaked AWS key is not remediation. The STS session that key produced outlives it. Revoke active sessions first, review CloudTrail for the affected identity, then rotate.
There is no CVE here — the tool is legitimate, the credentials were valid. The exposure is the permission set.
Full breakdown including the GitGuardian ARTEX lab test, Vapor Panda lineage, and the full IOC list: ThreatAft