The Pulse
AntiFox-linked infrastructure tied to AWS secret access, researchers say
Arctic Wolf Labs linked Alibaba Cloud systems hosting AntiFox interfaces to malicious activity against web services and AWS environments. In some instances, the activity reached a production secret, although the researchers did not identify how some AWS credentials were obtained.
Infrastructure hosting interfaces for the AntiFox AI penetration-testing platform was linked to malicious activity against web services and Amazon Web Services environments, Arctic Wolf Labs says. In some instances, the activity reached a production secret after attackers made authenticated requests using valid cloud identities.
The November 10 alert describes several intrusions associated with Alibaba Cloud systems hosting AntiFox interfaces. It links those systems to the activity but does not establish whether the AntiFox software itself issued the observed commands or API requests.
A testing tool linked to intrusions
AntiFox is an open-source agentic penetration-testing platform with a Chinese-language interface. BleepingComputer reports that AntiFox originated as a fork of ARTEX 0.1.1 and lets users deploy AI agents for tasks including mapping exposed services and probing endpoints for vulnerabilities.
Arctic Wolf describes activity associated with the hosting infrastructure that included web exploitation, deployment of web shells, discovery of configuration files, credential validation, cloud-service enumeration, secret access and storage operations. The security firm says agentic frameworks can make penetration-testing techniques more accessible to threat actors and increase the speed and consistency with which those techniques are applied in attacks.
Cloud requests and a production secret
In one intrusion, an AntiFox-linked source cycled through multiple AWS identities and made hundreds of cross-service API requests in approximately half an hour. Most of those requests were denied, but successful discovery and secret-access operations were mixed into the same burst, according to the researchers.
The identities included valid Identity and Access Management users and, in some instances, an assumed Elastic Compute Cloud role. The activity included searches across services such as IAM, EC2, S3, Lambda, Secrets Manager and Amazon Bedrock.
In some instances, the activity progressed from listing Secrets Manager resources to a successful GetSecretValue request against a production secret. In other activity, a valid AWS identity was used to discover S3 storage and carry out object operations including reads, copies and deletions.
Activity on a web server
In some of the activity, the initial foothold was associated with a compromised internet-facing IIS application. Endpoint telemetry showed the application's worker process creating an ASPX web shell and subsequently executing operating-system commands, the alert says.
On the affected server, commands inspected the application directory, checked permissions and tested whether files could be written into the web root. The attacker also parsed application settings and database connection strings, inspected debug and error-log directories, and attempted to connect to an internal production database using a credential from the application configuration; configuration and log files were copied into a web-accessible upload directory.
In other activity, the attacker began with a valid AWS credential obtained through unknown means; the alert does not establish that those AWS credentials came from the web server.
What researchers advise
For defenders, Arctic Wolf recommends correlating web-shell activity with subsequent AWS access and examining rapid sequences of requests across unrelated cloud services. The firm cautions against treating a sequence as unsuccessful simply because most requests were denied.
It also recommends rotating credentials exposed through application settings or configuration files, revoking affected AWS sessions and access keys, and reviewing activity associated with those identities. The alert says its indicators are not exhaustive and notes that public-cloud infrastructure may be reassigned or shared with unrelated tenants.