AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.
Arctic Wolf Labs said in a report shared with the outlet.
The activity has been observed chaining together web exploitation and web shell deployment to help configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations.
AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform that's built atop the solid foundation of ARTEX.
Given an authorized target, a planner / worker / main-agent multi-agent system runs the full engagement over a dual-graph core (a global asset graph + a per-task exploration graph) — recon → attack-surface discovery → exploitation → finding capture → report delivery — fully observable, interactive, and deliverable Unlike most automated pentest tools that are AntiFox puts its weight on delivery — turning what the AI finds into a report that an engineer can understand, reproduce, back with evidence, and hand straight to the client.
The access is then leveraged to create an ASPX web shell using the IIS worker process, and run operating system commands to perform the following actions - Arctic Wolf said.
The precise vulnerability used to achieve code execution on the IIS server is not known.
According to Arctic Wolf, some of the initial access activity is associated with a compromised internet-facing Internet Information Services (IIS) application.
While a majority of these authenticated cross-service API requests ended up with an AccessDenied error, some of the discovery and secret-access operations were successful, according to the cybersecurity company.
In other attacks, the threat actor is said to have started with a valid AWS credential obtained through as-yet-undetermined means.
Specifically, this involved abusing valid IAM identities to validate credentials and enumerate dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock.
Elsewhere, a valid AWS identity was used for S3 discovery and object operations via API calls.
The integration of AI has allowed adversaries, both large and small, to adapt established tradecraft and deploy them at machine speed, making it possible to progress from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes.
In a separate report, Check Point Research said it identified 2,557 systems that hosted ARTEX, including 10 misconfigured instances exposing their full databases.
What happened
Cybersecurity researchers have disclosed details of a campaign in which an emerging agentic penetration testing platform called AntiFox has been used to steal Amazon Web Services (AWS) credentials and pivot laterally into compromised environments.
Arctic Wolf Labs said in a report shared with the outlet.
The activity has been observed chaining together web exploitation and web shell deployment to help configuration discovery, credential validation, cloud-service enumeration, secret access, and storage operations.
What changed
AntiFox, available for download from GitHub, has been described as an artificial intelligence (AI)-driven autonomous penetration testing platform that's built atop the solid foundation of ARTEX.
Given an authorized target, a planner / worker / main-agent multi-agent system runs the full engagement over a dual-graph core (a global asset graph + a per-task exploration graph) — recon → attack-surface discovery → exploitation → finding capture → report delivery — fully observable, interactive, and deliverable Unlike most automated pentest tools that are AntiFox puts its weight on delivery — turning what the AI finds into a report that an engineer can understand, reproduce, back with evidence, and hand straight to the client.
Who is affected
The access is then leveraged to create an ASPX web shell using the IIS worker process, and run operating system commands to perform the following actions - Arctic Wolf said.
The precise vulnerability used to achieve code execution on the IIS server is not known.
Why it matters
According to Arctic Wolf, some of the initial access activity is associated with a compromised internet-facing Internet Information Services (IIS) application.
While a majority of these authenticated cross-service API requests ended up with an AccessDenied error, some of the discovery and secret-access operations were successful, according to the cybersecurity company.
Technical details
In other attacks, the threat actor is said to have started with a valid AWS credential obtained through as-yet-undetermined means.
Specifically, this involved abusing valid IAM identities to validate credentials and enumerate dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock.
Elsewhere, a valid AWS identity was used for S3 discovery and object operations via API calls.
Response
The integration of AI has allowed adversaries, both large and small, to adapt established tradecraft and deploy them at machine speed, making it possible to progress from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes.
In a separate report, Check Point Research said it identified 2,557 systems that hosted ARTEX, including 10 misconfigured instances exposing their full databases.
What remains unknown
The precise vulnerability used to achieve code execution on the IIS server is not known.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.