Attackers abuse AntiFox AI platform on Alibaba Cloud for AWS credential theft and webshell attacks
Security researchers at Arctic Wolf discovered that threat actors are abusing self-managed instances of AntiFox, an open-source AI-driven penetration testing tool hosted on Alibaba Cloud, to conduct malicious activities against AWS environments and web services. The attackers leveraged valid AWS IAM credentials and EC2 roles to make authenticated API requests, steal AWS secrets, deploy ASPX webshells on exposed IIS servers, execute OS commands, and access sensitive configuration files. Some attack attempts were blocked, but several succeeded in obtaining production secrets and manipulating S3 objects. Arctic Wolf recommends correlating IIS webshell activity with unusual AWS API usage and rotating exposed AWS credentials. AntiFox is a fork of ARTEX, which has been linked to Chinese cyber espionage campaigns targeting multiple organizations globally. Although AntiFox's publisher prohibits illegal uses, there are no technical controls to prevent abuse, meaning it remains a viable tool for attackers.
Linha do tempo
-
Attackers abuse AntiFox AI platform on Alibaba Cloud for AWS credential theft and webshell attacks
ler a análise desta fonte ocultar
Security researchers at Arctic Wolf discovered that threat actors are abusing self-managed instances of AntiFox, an open-source AI-driven penetration testing tool hosted on Alibaba Cloud, to conduct malicious activities against AWS environments and web services. The attackers leveraged valid AWS IAM credentials and EC2 roles to make authenticated API requests, steal AWS secrets, deploy ASPX webshells on exposed IIS servers, execute OS commands, and access sensitive configuration files. Some attack attempts were blocked, but several succeeded in obtaining production secrets and manipulating S3 objects. Arctic Wolf recommends correlating IIS webshell activity with unusual AWS API usage and rotating exposed AWS credentials. AntiFox is a fork of ARTEX, which has been linked to Chinese cyber espionage campaigns targeting multiple organizations globally. Although AntiFox's publisher prohibits illegal uses, there are no technical controls to prevent abuse, meaning it remains a viable tool for attackers.