Attackers misuse AntiFox to plant IIS webshells and reach AWS secrets
Original title: Hackers Abuse AntiFox AI Pentesting Tool to Deploy Webshells and Access AWS Production Secrets
AWS said its services were not compromised and that stolen customer application credentials were used.
Arctic Wolf linked Alibaba Cloud-hosted AntiFox interfaces to intrusions that deployed an ASPX webshell on internet-facing Microsoft IIS and then used valid AWS identities. Attackers issued hundreds of API requests in about 30 minutes against S3, EC2, Lambda, Secrets Manager, and Amazon Bedrock; most were denied, but some retrieved production secrets. A separate case read, copied, and deleted S3 objects. AntiFox is described as a dual-use fork of ARTEX 0.1.1, not a new malware family.
Unconfirmed: Reporting does not show every AWS intrusion began with an IIS webshell or how each credential was obtained.
- Reported source addresses are 47.79.4.33 and 8.208.101.210, with interface port TCP/8787.
- Webshell names matched pwn*.aspx; related files included cfg*.txt, wc*.txt, and el*.txt.
- AWS activity used user agent Boto3/1.43.125 Botocore/1.43.125.
- A lab ARTEX build without a secret scanner found eight of nine planted credentials in six to 13 seconds.
- Investigators saw an attempt to reach an internal production database; success is not established.
Impact: Production secrets retrieved; S3 objects read, copied, and deleted
- 1.Revoke affected AWS sessions and access keys and rotate exposed application credentials.
- 2.Review successful API calls inside bursts of access-denied errors.
- 3.Require IMDSv2 and enable GuardDuty, as AWS recommends.
- ATT&CK
- T1505.003 Web ShellT1059 Command and Scripting InterpreterT1552.001 Credentials In FilesT1078 Valid AccountsT1530 Data from Cloud Storage
- Organizations
- Arctic WolfGitGuardian
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 47.79.4.33 | (IoCs):- Type Reported indicator Hunting context Source IP 47[.]79[.]4[.]33 AntiFox-linked infrastructure Source IP 8[.]208[.]101 |
| ipv4 | 8.208.101.210 | IP 47[.]79[.]4[.]33 AntiFox-linked infrastructure Source IP 8[.]208[.]101[.]210 AntiFox-linked infrastructure Interface port TCP/8787 |
From the original article
3 min read at cybersecuritynews.com
Attackers are abusing AntiFox, an open-source AI penetration-testing platform, to compromise web applications, deploy webshells, and access Amazon Web Services production secrets. Arctic Wolf linked the activity to Alibaba Cloud infrastructure hosting AntiFox interfaces, connecting those systems to malicious actions against internet-facing applications and associated AWS environments.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.