Attackers are using self-hosted instances of the open-source AntiFox agentic penetration-testing platform to compromise internet-facing web services and move into associated Amazon Web Services environments, according to research from Arctic Wolf reported by BleepingComputer. The activity linked Alibaba Cloud infrastructure running AntiFox to vulnerability exploitation, web-shell deployment, credential validation and cloud reconnaissance.
In one documented intrusion, the attackers deployed an ASPX web shell on an exposed Microsoft Internet Information Services server, executed operating-system commands and accessed application settings and database connection strings. They then copied configuration and log files into a web-accessible directory, creating a path to credentials stored in application files. AntiFox began as a fork of ARTEX 0.1.1 and provides a Chinese-language interface for automating reconnaissance, attack-surface mapping and vulnerability testing; its GitHub repository describes a multi-agent workflow spanning reconnaissance, exploitation and reporting.
Arctic Wolf observed the intruders using valid AWS IAM identities, including assumed EC2 roles, to issue authenticated API requests. In one case, the attackers rotated through multiple identities and generated hundreds of requests in roughly 30 minutes, probing services such as IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, EKS and Bedrock. Most requests were denied, but the researchers confirmed successful access to production secrets through AWS Secrets Manager; a separate incident involved reading, copying and deleting S3 objects.
The findings describe abuse of legitimate credentials rather than a newly disclosed AntiFox vulnerability. No CVE identifier, CVSS score, public exploit or vendor patch was identified in the reporting reviewed, and Arctic Wolf did not publicly attribute the activity to a named threat group. The risk instead comes from chaining a compromised IIS application, exposed cloud credentials and highly automated enumeration into a broader cloud-account intrusion.
Defenders should investigate IIS web-shell activity alongside unusual AWS API activity, paying particular attention to successful calls that follow bursts of authorization failures. Organizations should revoke affected sessions and access keys, rotate credentials found in application or configuration files, review CloudTrail records for Secrets Manager and S3 actions, and verify whether accessed secrets or objects were subsequently used. The AntiFox project remains publicly available and reportedly prohibits attacks against live systems, but the published project does not describe technical controls that enforce those restrictions.
