AntiFox: The AWS Breach Where Most Requests Were Denied

A self-hosted AI pentest platform forked from ARTEX compromised an IIS web application, extracted AWS credentials from web.config, and made hundreds of API calls across 18 services in roughly 30 minutes, with most returning AccessDenied but one yielding a production secret. The writeup argues denial counts are the wrong detection metric, since each AccessDenied narrows the permission boundary, and recommends alerting on successful GetSecretValue calls from hosting-provider ASNs, hunting single source IPs cycling IAM users, and correlating IIS web-shell activity with CloudTrail. It also notes that deleting a leaked key is not remediation because the resulting STS session outlives it — active sessions must be revoked first.

An AI pentest platform forked from ARTEX, self-hosted on Alibaba Cloud, compromised an IIS web application, extracted AWS credentials from web.config, and made hundreds of API calls across 18 services in approximately 30 minutes. Most returned AccessDenied. One returned a production secret. Why the denial count is the wrong metric An agent enumerating a permission boundary doesn’t stop after a few failures — it has no reason to. Each AccessDenied narrows the boundary. The burst isn’t a failed intrusion; it’s the search phase of a successful one. What actually works for detection Alert on successful GetSecretValue from hosting-provider ASNs that have never touched the account Hunt for a single source IP cycling multiple IAM users or assumed roles in a short window Tie IIS web-shell activity w3wp.exe spawning cmd.exe/powershell.exe to subsequent AWS CloudTrail activity — the two halves of this intrusion are minutes apart, not days Remediation note Deleting a leaked AWS key is not remediation. The STS session that key produced outlives it. Revoke active sessions first, review CloudTrail for the affected identity, then rotate. There is no CVE here — the tool is legitimate, the credentials were valid. The exposure is the permission set. Full breakdown including the GitGuardian ARTEX lab test, Vapor Panda lineage, and the full IOC list: ThreatAft