Arctic Wolf links AntiFox tool to IIS and AWS intrusions

Arctic Wolf Labs has published findings that attackers are weaponising AntiFox, an open‑source, agentic penetration testing platform, to target IIS servers and AWS accounts. The research notes that Alibaba Cloud systems hosting AntiFox interfaces were linked with confirmed malicious activity against internet‑facing web services and the AWS environments behind them.

In some intrusions, attackers gained entry via a public IIS application, while in others they started with valid AWS credentials, the provenance of which remains unclear. Arctic Wolf emphasizes that these self‑hosted frameworks “make penetration testing techniques easier to reach for attackers, and they make those techniques faster and more consistent in live attacks.”

The investigation details how the IIS attacks unfolded: the w3wp.exe process yielded an ASPX web shell, allowed information gathering about the system, and surfaced configuration data via web.config, with attackers examining database connections, application settings and debug logs. Using credentials from configuration files, they attempted to connect to internal databases and copied configuration files and logs to an accessible upload folder.

On AWS, the activity involved valid IAM accounts or an assumed EC2 role, with commands such as GetCallerIdentity, ListUsers, ListRoles and ListKeys to map identities, permissions and secrets. Although most requests returned AccessDenied, some succeeded, enabling further discovery across services including IAM, S3, Secrets Manager and more.

The report advises enabling CloudTrail, protecting S3 data with versioning and Object Lock, and revoking compromised credentials, while monitoring for unusual IAM activity and anomalous AWS calls.