Someone spent three days trying to steal our AWS credentials. We didn't notice until it was over.
Andrew Naeve,
So far in StrataSpace’s short life, we’ve had around 3 major cyber attacks where hackers have attempted to probe us for weaknesses. Some have been pretty sophisticated.
What they tried
Most recently, a single actor ran a multi-day campaign from rotating cloud IPs across three countries. They pointed our MCP connector URLs at the AWS instance metadata endpoint, the same SSRF pattern behind the 2019 Capital One breach, trying to steal live IAM creds. When that didn’t work, they pivoted to nip.io hostnames to smuggle internal addresses past URL filters and spun up Trycloudflare tunnels to host hostile MCP servers and test for blind SSRF, trying to reach our Redis cluster directly.
On the auth side, they fired off 39 cross-tenant doc reads, and ran stop-word searches designed to make search return as much content as possible, fishing for results that leaked across tenant boundaries. They also forged 8 JWTs, probing whether our token verification had any cracks. They registered rogue OAuth clients through MCP dynamic client registration, likely testing consent and token-issuance flows for cross-account abuse.
What we missed
Every single attempt was denied. No customer data was read, no credentials were exposed, no internal services were reached. However, we didn’t notice the attack until it was over. We only found it while looking through error alarms that went off in our account at 3AM as a result of sending invalid params. But from this came the observation that likely, we are not the only ones dealing with a surge of hacker activity. The same tools that make it easy to spin up a new app make it easy to become a “researcher”, no prior experience required.
What we built
In response, we created an Agent that deals with threats overnight, and surfaces alerts throughout the day, kind of like a home alarm system. Evidence is built by looking through sensor data we deploy in middleware, and once an Agent has a solid case, it can temporarily suspend accounts or block IPs according to your policy. I leave it to “page” during the day, “full auto” with max 15 min ban overnight.
It’s called Bowshock, and StrataSpace runs on it now. I’m looking for a few founders of small teams to try it with us as design partners. If this sounds familiar, join the waiting list or book a call below.