Attackers Abuse AI Pentest Tool AntiFox to Steal AWS Credentials and Compromise IIS Servers
Threat actors have been observed abusing AntiFox, an open-source Chinese-language agentic penetration testing platform, to automate attacks against internet-facing IIS web servers and AWS environments. Arctic Wolf Labs reports that attackers exploited either unknown vulnerabilities in public IIS applications or valid AWS credentials (obtained through undisclosed means) to gain access. On IIS servers, attackers deployed ASPX web shells and used PowerShell to collect sensitive configuration files and escalate access. In AWS environments, they leveraged legitimate IAM credentials and EC2 roles to enumerate multiple services, attempt to retrieve secrets, list and manipulate S3 buckets, and perform rapid, automated discovery. Most AWS API requests were denied; however, successful accesses allowed the extraction of production secrets and data. Arctic Wolf emphasizes that AntiFox enables faster, consistent exploitation by automating complex pentest workflows, reducing manual effort and increasing attack effectiveness. Defenders are advised to monitor AWS activity for unusual multi-user requests, new .aspx files in IIS uploads, unexpected PowerShell usage, and suspicious secret access. They should also enable AWS CloudTrail logging, use S3 versioning and Object Lock, patch internet-facing applications, isolate compromised servers, and enforce least-privilege AWS permissions.
Linha do tempo
-
Attackers Abuse AI Pentest Tool AntiFox to Steal AWS Credentials and Compromise IIS Servers
ler a análise desta fonte ocultar
Threat actors have been observed abusing AntiFox, an open-source Chinese-language agentic penetration testing platform, to automate attacks against internet-facing IIS web servers and AWS environments. Arctic Wolf Labs reports that attackers exploited either unknown vulnerabilities in public IIS applications or valid AWS credentials (obtained through undisclosed means) to gain access. On IIS servers, attackers deployed ASPX web shells and used PowerShell to collect sensitive configuration files and escalate access. In AWS environments, they leveraged legitimate IAM credentials and EC2 roles to enumerate multiple services, attempt to retrieve secrets, list and manipulate S3 buckets, and perform rapid, automated discovery. Most AWS API requests were denied; however, successful accesses allowed the extraction of production secrets and data. Arctic Wolf emphasizes that AntiFox enables faster, consistent exploitation by automating complex pentest workflows, reducing manual effort and increasing attack effectiveness. Defenders are advised to monitor AWS activity for unusual multi-user requests, new .aspx files in IIS uploads, unexpected PowerShell usage, and suspicious secret access. They should also enable AWS CloudTrail logging, use S3 versioning and Object Lock, patch internet-facing applications, isolate compromised servers, and enforce least-privilege AWS permissions.