Overview
Researchers at Arctic Wolf report that attackers are using AntiFox, an open-source agentic penetration-testing platform, to target internet-facing web services and the AWS environments behind them. The threat actors run self-managed AntiFox instances on Alibaba Cloud infrastructure. Arctic Wolf published its findings in a report on GitHub (rtkwlf/wolf-tools).
About AntiFox
- Forked from ARTEX 0.1.1, with a Chinese-language interface.
- Automates mapping of exposed services and probing endpoints for vulnerabilities.
- Version 2.0 is publicly available on GitHub.
- Its publishers prohibit use against live systems or for illegal activity, but no technical controls enforce that.
ARTEX has been linked to earlier AI-assisted misuse, including attacks on South Korean banks, and CrowdStrike tied it to the Vapor Panda campaign, which targeted more than 200 organizations in 14 countries.
Observed Activity
Arctic Wolf observed vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting.
IIS intrusion example
- An ASPX webshell was deployed on an internet-exposed IIS server.
- The attacker ran OS commands and read application settings and database connection strings.
- Configuration and log files were copied to a web-accessible directory.
AWS credential abuse
- The agent used valid IAM user credentials and, in some cases, assumed EC2 roles.
- It cycled through multiple identities, sending hundreds of API requests in about 30 minutes.
- Most attempts were blocked, but some succeeded and returned production secrets.
- In a separate incident, a valid AWS identity was used to read, copy, and delete S3 objects.
The report does not list indicators of compromise in the article summary; see Arctic Wolf's GitHub report for details.
Defensive Guidance
- Correlate web-tier and cloud activity. Link IIS webshell findings with unusual AWS access.
- Review successful calls inside bursts of denied requests in CloudTrail; a flurry of
AccessDeniedfollowed by a success is the signature of automated credential testing. - Revoke affected sessions and keys, and rotate credentials stored in application config files.
- Remove long-lived secrets from web roots and config files; prefer IAM roles with short-lived credentials and least privilege.
- Alert on S3 read/copy/delete bursts and on role assumption from unfamiliar IPs or cloud providers.
Why It Matters
Agentic tooling compresses the time between initial foothold and credential theft. Dual-use security platforms built for defenders are easily repurposed, and the same automation that speeds up a pen test speeds up an intrusion.