Severity: High | Priority: 1
AntiFox is an open-source, self-hosted, Chinese-language penetration-testing platform. It uses AI agents to carry out reconnaissance, exploitation and reporting with little human input. Arctic Wolf has linked AntiFox instances on Alibaba Cloud to real intrusions against internet-facing web applications and the AWS environments behind them. The tool itself is a dual-use framework, not malware. The concern is that it lets attackers run a full attack chain at machine speed with minimal skill.
The intrusions started in one of two ways. In the first, the attacker got code execution on a public IIS application (the vulnerability has not been identified) and planted an ASPX web shell through the IIS worker process. They checked their permissions and write access to the web root, then read web.config to pull out database connection strings and application settings. They copied configuration and log files into a web-accessible upload folder for collection, and used one of the stolen credentials to try to reach an internal production database. In the second, the attacker began with a valid AWS credential obtained by unknown means. In about half an hour they made hundreds of API calls across IAM, EC2, S3, Lambda, KMS, RDS, EKS and Bedrock. Most were denied, but a request to read a production secret succeeded, and some S3 read, copy and delete operations also went through.
For internet-facing IIS servers in your network, keep applications patched and check web directories for unexpected ASPX files, especially names starting with “pwn”. Look in upload folders for unexpected text files containing configuration or log data, and watch for the IIS worker process (w3wp.exe) launching PowerShell or cmd.exe. Don’t keep database or cloud credentials in plain text in web.config. If a server may have been compromised, rotate every credential that was stored on it.
For AWS, review CloudTrail for bursts of API activity from hosting-provider networks or unfamiliar Boto3 clients, and pay particular attention to secret reads and S3 copy or delete calls. A run of mostly denied requests does not mean the attack failed. Apply least privilege to IAM users and roles, and require IMDSv2 on EC2 instances to make instance-role credentials harder to steal.