Attackers use AntiFox, an Artex variant, against IIS and AWS
Arctic Wolf says the agentic tool planted web shells, ran OS commands, and exposed secrets and S3 data.
68
Product
Internet Information Services
- Mentions · 7d1
- Mentions · 30d1
- All mentions2
- First seenAug 31, 2026
- Last mentioned3h ago
Timeline
2 articles · newest firstPrivilege escalation from IIS AppPool to NT Authority/SYSTEM
A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.
42
Appears with
- Microsoftvendor · 2
- Artexmalware · 1
- AWSproduct · 1
- Amazonvendor · 1
- Active Directory Certificate Servicesproduct · 1
- AntiFoxmalware · 1
- A Securityorganization · 1
- Arctic Wolf Labsorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.