AntiFox linked to attacks that accessed AWS production secrets

Researchers at Arctic Wolf linked the AntiFox agentic penetration testing platform to attacks that stole Amazon Web Services credentials and accessed production secrets, according to The Hacker News. Systems hosted on Alibaba Cloud and running AntiFox interfaces were associated with malicious activity against web services exposed to the internet and related AWS environments.

In one intrusion, attackers compromised a Microsoft IIS application and used the w3wp.exe worker process to create an ASPX web shell. They then checked the execution context, listed application files, inspected permissions and tested whether they could write files to the web root. The vulnerability used to gain access remains unknown.

Other activity began with valid AWS credentials obtained through an unknown method. The attackers used IAM identities to check credentials and enumerate services including EC2, S3, Lambda, Secrets Manager, KMS and Amazon Bedrock. Most requests returned AccessDenied errors, but some succeeded, including a GetSecretValue request for a production secret and API calls for S3 discovery and object operations.