Attackers abuse AntiFox pentest tool against IIS and AWS
Original title: AI Pentest Tool AntiFox Abused To Steal AWS Credentials
Arctic Wolf tied Alibaba-hosted AntiFox interfaces to web shells, config theft, and AWS secret and S3 access.
Arctic Wolf Labs reported intrusions in which attackers used AntiFox, an open-source Chinese-language agentic penetration-testing platform, against internet-facing web services and linked AWS environments. On IIS, the worker process wrote an ASPX web shell, enumerated the host, read web.config for database details, and staged config and logs in a web-accessible folder. In AWS, valid IAM users or an assumed EC2 role rapidly listed services; most calls were denied, but some retrieved production secrets or copied and deleted S3 objects. The initial IIS flaw and the source of the AWS credentials were not identified.
Unconfirmed: Arctic Wolf could not identify the IIS vulnerability or how the valid AWS credentials were obtained.
- Alibaba Cloud systems hosted the AntiFox interfaces tied to the intrusions.
- One AWS source cycled identities and sent hundreds of requests in about half an hour.
- Enumeration covered IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS and other services.
- Some sequences ended with a successful GetSecretValue call on a production secret.
- Hunt for w3wp.exe spawning shells and one IP using many AWS keys quickly.
Impact: Web shells, config and secret theft, S3 copy and deletion
| Product | Affected |
|---|---|
| Microsoft IIS | — |
| Amazon AWS | — |
- 1.Enable CloudTrail, S3 versioning and Object Lock, and alert on unusual secret access.
- 2.Hunt w3wp.exe launching shells and new ASPX files in upload or temp folders.
- 3.If compromised, isolate the server, rotate credentials, and revoke AWS keys and sessions.
- ATT&CK
- T1505.003 Web ShellT1078.004 Cloud AccountsT1552.001 Credentials In FilesT1580 Cloud Infrastructure DiscoveryT1530 Data from Cloud Storage
- Malware
- AntiFox
- Organizations
- Arctic WolfAlibaba Cloud
From the original article
3 min read at securityaffairs.com
Arctic Wolf saw attackers use the AntiFox pentest platform to hit IIS servers and AWS accounts. Arctic Wolf Labs has published research on attackers using AntiFox, an open-source, Chinese-language agentic penetration testing platform. These frameworks chain attack steps together with little human effort.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.