AntiFox-Linked Activity Exposed AWS Production Secrets After Web Server Compromises
Security researchers have linked activity involving AntiFox, an agentic penetration-testing platform, to intrusions that reached production secrets in Amazon Web Services (AWS) environments. The observed operations combined web application compromise, command execution on Internet Information Services (IIS) servers, and the use of valid AWS identities to discover cloud resources and access credentials.
Arctic Wolf Labs reported that Alibaba Cloud systems hosting AntiFox interfaces were associated with malicious actions against internet-facing web services and related AWS environments. The researchers described activity that included configuration discovery, credential validation, cloud-service enumeration, secret access and storage operations. Their findings do not establish how the actors obtained every credential or identify the precise vulnerability used in the IIS compromises.
Web server access led to configuration discovery
In one set of incidents, initial access was associated with a compromised internet-facing IIS application. Commands executed through the IIS worker process, w3wp.exe, were followed by creation of an ASPX web shell. The actor then used the foothold to run operating-system commands and inspect the server.
The activity included searching for web.config files and backups, reading application settings and database connection strings, and locating debug and error logs. The intruder also tested file-system permissions and whether files could be written into the web root. Researchers said commands were used to attempt a connection to an internal production database with a credential taken from application configuration.
Configuration and log files were copied to a web-accessible upload directory. The sequence—web-shell creation by w3wp.exe followed by command execution through the same process—was consistent with compromise through the affected web application, according to Arctic Wolf. The specific flaw that enabled code execution remains unknown, so the report does not identify a vulnerability or affected software version to patch.
Valid AWS identities enabled service discovery
In other observed activity, the operator began with a valid AWS credential obtained by an undetermined method. The identity was used to validate access and query a broad range of AWS services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB and Amazon Bedrock.
Many of the cross-service requests returned AccessDenied, but some discovery and secret-access operations succeeded. In at least some cases, the activity progressed from enumerating Secrets Manager to a successful GetSecretValue request for a production secret. Researchers also observed a valid AWS identity used for S3 discovery and object operations. The findings show why denied requests alone may not demonstrate that a cloud identity was harmless: some permissions or resources may still be accessible.
For defenders, the reported activity underscores the need to investigate web-server behavior and cloud identity use together. Organizations can review IIS processes for unexpected web-shell creation or command execution, and assess whether application configuration files, backups and logs are exposed to the web-server process or placed in publicly reachable directories. They should also determine whether application credentials are stored in those files and rotate any secrets that may have been accessed.
On AWS, security teams can examine identity and service activity for unusual enumeration, unexpected Secrets Manager reads, and S3 discovery or object operations. Reviewing the permissions assigned to application and human identities can help limit the impact of a stolen credential. These are defensive measures based on the observed techniques; the report does not provide specific indicators of compromise or a named credential-theft method.
AntiFox is part of a wider agentic tooling trend
AntiFox is described in its project materials as an autonomous AI-driven penetration-testing platform built on ARTEX. Its documented workflow uses planner, worker and main-agent roles to move through reconnaissance, attack-surface discovery, exploitation, evidence capture and report delivery. Such capabilities can automate sequences of actions, but the presence of the tool does not by itself establish who operated a particular system or whether a deployment was used maliciously.
Arctic Wolf warned that agentic frameworks can make established penetration-testing techniques easier to apply and more consistent during live attacks. Separate research cited in the reporting also described ARTEX systems being used in activity targeting cryptocurrency, Apple code-signing certificates, gaming accounts and gambling websites. Those broader findings are distinct from the AWS incidents and should not be treated as evidence that every AntiFox or ARTEX deployment is malicious.
The operational lesson is to treat a compromised application server and its stored credentials as a potential path into cloud production environments. Restricting application access to secrets, reducing identity permissions, and correlating web-server events with cloud audit activity can help organizations detect and contain that path before further resources are accessed.
