Arctic Wolf says attackers ran self-hosted AntiFox, an AI agent pentest platform, from Alibaba Cloud to plant webshells and harvest AWS secrets. We turn the alert's prose into concrete checks, explain why agents change the pace of an intrusion, and separate what the alert shows from what it does not.
This explains reporting by
Arctic Wolf Labs: AntiFox, Alibaba-hosted platforms facilitate web and cloud intrusions (November 10, 2026). Read the original first:
In one minute #
- AntiFox is an open-source agentic penetration testing platform, forked from ARTEX 0.1.1, with a Chinese-language interface, per BleepingComputer. Version 2.0 is on GitHub.
- Arctic Wolf saw attackers run their own AntiFox instances on Alibaba Cloud. In one case they dropped an ASPX webshell on an internet-facing IIS server and read database connection strings.
- With valid AWS identities, including assumed EC2 roles, they made hundreds of API calls in about 30 minutes. Most were denied, some succeeded, and production secrets were taken.
- The alert gives indicators: two source IPs, TCP port 8787, Boto3 and Botocore 1.43.125 user agents, w3wp.exe spawning shells, and API pairs like ListSecrets then GetSecretValue.
- The best single hunt: successful AWS calls hidden inside a burst of denied ones, from a hosting provider your identities have never used.
What AntiFox is #
BleepingComputer describes AntiFox as an open-source agentic penetration testing platform, forked from ARTEX 0.1.1, with a Chinese-language interface. It lets a user deploy AI agents that map exposed services and probe them for weaknesses. Its publishers forbid use against live systems, but BleepingComputer notes they describe no technical controls that enforce this.
ARTEX itself went closed-source after it was used against South Korean banks, per the same report. AntiFox is the fork that stayed open.
Arctic Wolf's alert lists how to recognize a running instance from the outside: a web interface titled 'AntiFox' followed by Chinese text meaning autonomous penetration testing console, on TCP port 8787, with a banner hash it publishes.
What the attackers did with it #
Arctic Wolf describes self-managed AntiFox instances hosted on Alibaba Cloud, used for vulnerability exploitation, webshell deployment, credential checks, configuration discovery and AWS secret harvesting.
On the web side, an ASPX webshell landed on an internet-facing IIS server. The attacker ran operating system commands, read application settings and database connection strings, and copied configuration and log files into a web-reachable folder.
On the cloud side, the attacker used valid AWS identities, IAM users and in some cases assumed EC2 roles, cycling through several of them. BleepingComputer reports hundreds of API requests in about 30 minutes; most were blocked, some succeeded, and production secrets were obtained. In a separate case, a valid identity read, copied and deleted S3 objects.
Why agents change the pace #
A human attacker with stolen keys tries one thing, reads the error, and tries the next. An agent loop does the same thing without pausing, and can fan out across several identities at once. Hundreds of calls in half an hour is that pattern.
The upside for defenders is that the pattern is loud. A wall of AccessDenied errors from one source is unusual for a real workload. The danger is the handful of calls that succeed inside that wall, because those are the ones that return secrets. Arctic Wolf's advice to review successful calls inside bursts of denied ones is aimed at exactly this.
This is our reading of the alert's numbers, not a claim Arctic Wolf makes about agents in general.
Concrete checks #
Arctic Wolf gives hunting guidance in prose, not ready-made queries. Here it is turned into things you can look for:
- CloudTrail pairs from the alert: ListSecrets then GetSecretValue; GetCallerIdentity then ListBuckets; ListBuckets then ListObjects; ListObjects then GetObject or HeadObject.
- One source IP using several access keys or roles in a short window, or AWS API calls from a hosting provider or ASN an identity has never used.
- User agent strings Boto3/1.43.125 and Botocore/1.43.125 (they can change, so treat them as a hint).
- On IIS: w3wp.exe starting cmd.exe, powershell.exe or where.exe, and cmd.exe starting whoami.exe or icacls.exe. New files matching pwn*.aspx, cfg*.txt, wc*.txt or el*.txt in an upload folder.
- PowerShell that touches WebConfigurationManager or ConnectionStrings.
A quick first look with the AWS CLI, for one event name in one region:
aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=GetSecretValue \
--start-time 2026-11-01T00:00:00Z --max-results 50
The alert also lists two source IPs, 47[.]79[.]4[.]33 and 8[.]208[.]101[.]210, and notes that cloud IPs can be reassigned or shared.
If you find something #
Arctic Wolf's response steps: revoke the affected AWS sessions and keys, rotate every credential exposed through application files, and correlate IIS webshell activity with unusual AWS access, since the two halves of this intrusion were linked.
Two habits make the AWS half harder. Keep secrets in a secrets service with narrow read permissions, not in web.config files on an internet-facing server. And alert on GetSecretValue from any identity that does not normally call it.
Who is affected #
| Case | Status |
|---|---|
| Internet-facing IIS servers with exploitable web apps | Used as the entry point in one documented intrusion. |
| AWS accounts whose keys or roles were reachable from those servers | Probed with valid identities; some secrets and S3 objects were taken. |
| Number of victim organizations | Not stated by Arctic Wolf or BleepingComputer. |
What to do #
- Search CloudTrail for the event pairs above, starting with GetSecretValue.
- Look for w3wp.exe starting shells on IIS servers.
- Move connection strings and keys out of config files into a secrets service.
- Revoke and rotate any AWS key found on a web server.
- Alert on bursts of AccessDenied followed by success from one source.
What is still unknown #
- Arctic Wolf does not name the attacker or say how many organizations were hit.
- How the attackers got valid AWS identities in each case is not fully described; the IIS case suggests keys read from application files.
- Which AI model AntiFox drives is not stated in the sources we read.
- The indicators are not exhaustive, per Arctic Wolf, and the IPs may be shared cloud addresses.
Sources #
- Arctic Wolf Labs: AntiFox, Alibaba-hosted platforms facilitate web and cloud intrusions (November 10, 2026) — the original report
- BleepingComputer: Hackers use AntiFox AI agents in AWS credential-theft attacks
AI News Report· every headline, every morning.