Arctic Wolf Labs says attackers are running self-hosted copies of AntiFox, an open-source “agentic penetration testing platform,” on Alibaba Cloud and using it to break into web services and pivot into AWS, The Hacker News and BleepingComputer report.
- AntiFox started as a fork of ARTEX 0.1.1 and has a Chinese-language interface. On GitHub it has about 474 stars and 251 forks.
- In one intrusion, the attackers dropped an ASPX web shell on an internet-facing IIS server through w3wp.exe, hunted for web.config files and backups, read connection strings, and tried them against an internal production database.
- They then used valid IAM users, and in some cases assumed EC2 roles, to enumerate AWS services and pull secrets and storage data.
I’ve written about ARTEX before, when hundreds of deployments were found sitting wide open on the internet. This is the next step: the same kind of tool, used on purpose by attackers.
My take
AI pentest agents work just as well for the bad guys, and they’re faster. The defenses are the same old ones: patch your internet-facing apps, keep connection strings and cloud keys out of web.config backups, scope your IAM roles tightly, and actually look at CloudTrail for API calls from places that make no sense.
God Bless, and Happy hacking!
