PromptStorm Cyber Range

An AI-enabled AWS environment starts throwing off quiet signs that something is wrong.

Underneath it is an active breach that has reached into identity, automation, and observability all at once. The job is to work out what is happening, take back control, and drive the incident to resolution without destabilizing production systems.

Pwned Labs gives responders searchable OpenSearch logs and prebuilt dashboards, and the incident plays out over nine challenges of mixed difficulty across the incident response lifecycle.

• In-depth knowledge of AWS and Linux CLI
• Knowledge of web vulnerabilities
• Experience with assessing cloud infrastructure
• Ability to undertake independent research

Practice this at Pwned Labs

Pwned Labs teaches the AWS log investigation skills that PromptStorm builds on in individual blue team labs. The first two labs below are free.

• Breach in the Cloud (Free, Beginner): confirm a breach from AWS CloudTrail logs, identify the compromised service and any exfiltrated data, then retrace the attacker's route to validate the path to breach.
• Identify IAM Breaches with CloudTrail and Athena (Free, Beginner): configure AWS CloudTrail and Amazon Athena, then query the logs from the console and the CLI to identify malicious IAM activity and compromised IAM users.
• Hunt in the Cloud with Splunk (Premium, Beginner): investigate a pattern of AWS service outages in CloudTrail data with Splunk and separate routine operational activity from attacker activity.

As organizations migrate to the cloud, it's critical that they thoroughly examine and lock down their services.

A misconfiguration or overly permissive policy could be the foothold a threat actor needs to gain access and move laterally across services!

Pwned Labs built PromptStorm in collaboration with Permiso Security, and its attack patterns follow tradecraft documented in Permiso's research into GUI-Vil, a financially motivated threat group that uses compromised credentials to run unauthorized cryptocurrency mining in AWS.

Frequently asked questions

What is the PromptStorm scenario?

An AI-enabled AWS environment starts showing quiet signs that something is wrong: cloud costs rise without a clear cause, logs contain unexpected content, access patterns stop matching intended behavior and audit visibility degrades at a critical moment. Underneath is an active breach across identity, automation and observability, and the job is to resolve it without destabilizing production.

Is PromptStorm a red team or a blue team range?

PromptStorm is a blue team incident response range in the Pwned Labs SkyFall Enterprise Cyber Range Collection, built for blue team practitioners, cloud incident responders, detection engineers and SOC leads. It also gives red teamers a defender’s view of how AI-enabled attacks are detected.

What does PromptStorm test?

Investigating AI-related security failures, tracing identity abuse across cloud services, operating with incomplete or degraded logging, distinguishing operational noise from adversary activity, making containment decisions under pressure, and driving remediation and recovery without collateral damage.

What real-world attacks is PromptStorm based on?

The attack patterns and abuse paths follow tradecraft documented in Permiso Security’s research into the GUI-Vil threat actor. Pwned Labs built the range in collaboration with Permiso, whose research into cloud and LLM abuse shaped both the attack chain and the defensive challenges.

How do teams get access to PromptStorm?

Teams can see PromptStorm in action and request pricing from Pwned Labs through a demo request.