Arctic Wolf Labs says attackers are running AntiFox, an open-source, Chinese-language agentic penetration-testing platform, from Alibaba Cloud servers and using it against web services and the AWS environments behind them. In “several recently observed intrusions,” Arctic Wolf says, AntiFox-hosting systems were tied to confirmed malicious actions: web exploitation, web-shell deployment, configuration discovery, credential validation, cloud-service enumeration, secret access and storage operations.
In one case, a process on a compromised Windows IIS server (w3wp.exe) created an ASPX web shell and ran commands that located web.config files, read application settings and database connection strings, and copied configuration and log files into a web-accessible upload directory. Arctic Wolf did not identify the vulnerability used to get code execution. In another, the AntiFox-linked source cycled through several AWS identities and made hundreds of API requests in about half an hour, enumerating services from IAM and S3 to Secrets Manager and Bedrock. Most requests were denied, but successful calls were mixed in, ending in some cases with a successful GetSecretValue request against a production secret. A separate intrusion used a valid AWS identity to read, copy and delete S3 objects. In some cases the attacker started with a valid AWS credential “obtained through unknown means.”
BleepingComputer adds that AntiFox began as a fork of ARTEX 0.1.1, the agentic pentest framework we covered in Chinese Hackers Ran ARTEX AI Agents Against 200 Organizations, and that its GitHub project has been updated to version 2.0. Its publishers prohibit use against live systems or for illegal activity but, BleepingComputer notes, describe no technical controls that enforce that.
How to check if you’re affected
Affected products are internet-facing IIS web applications and any AWS identity (IAM user or EC2 role) whose keys or secret references sit in application files. There is no version to check: Arctic Wolf did not name the flaw used for initial code execution. The checks below are from Arctic Wolf’s hunting and defensive guidance.
- Look in CloudTrail for AWS API calls from hosting providers or networks not previously tied to that identity, and for one source IP using several access keys, users or roles in a short span. Do not treat a burst as harmless because most calls were denied; successes were interspersed. Review GuardDuty findings for credential-access and discovery activity.
- On IIS servers, look for w3wp.exe spawning cmd.exe, powershell.exe, whoami.exe or icacls.exe, and for new .aspx files in upload, temporary or other user-writable web directories. Configuration or log files copied into web-accessible folders under .txt or image extensions are suspicious.
- Indicators Arctic Wolf lists (not exhaustive, and cloud addresses may be reassigned): source IPs 47[.]79[.]4[.]33 and 8[.]208[.]101[.]210, the AntiFox web interface on TCP/8787, file names matching pwn*.aspx, cfg*.txt, wc*.txt and el*.txt, and the user agent Boto3/1.43.125 Botocore/1.43.125.
- If you find a compromised web server: Arctic Wolf says to isolate it, preserve the web root, IIS logs and memory before reimaging, remove unauthorised ASPX files, rotate every credential exposed in web.config, app settings, debug logs and backups, and revoke the AWS sessions and keys for the affected identities after reviewing their CloudTrail history.
- Hardening it recommends: alert on successful GetSecretValue from unfamiliar infrastructure, enforce IMDSv2 with a restrictive hop limit, give application identities least-privilege policies, and enable S3 versioning (and Object Lock where suitable) on critical buckets.
Sources
- Arctic Wolf Labs: AntiFox, Alibaba-hosted platforms facilitate web and cloud intrusions (wolf-tools pack alert)
- BleepingComputer: Hackers use AntiFox AI agents in AWS credential-theft attacks
- The Hacker News: AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
- AntiFox project README (GitHub)