Arctic Wolf Labs reported that attackers used AntiFox, an open-source Chinese-language agentic penetration-testing platform, in attacks on internet-facing IIS web applications and AWS environments that led to the theft of production secrets. The report was published on November 11, and it describes the intrusion dates only as recent.
What Arctic Wolf Found Hosting AntiFox
Arctic Wolf Labs observed Alibaba Cloud systems hosting AntiFox. The platform is a fork of ARTEX 0.1.1 and has 251 forks and 474 stars. Arctic Wolf tied the hosted platform to attacks on web services and AWS environments. The report does not give exact intrusion dates.
Two Routes Into the Victim Environments
The attackers entered through two different paths, according to Arctic Wolf.
Compromised IIS Application and ASPX Web Shell
In the first path, the attackers compromised a public IIS application through a vulnerability that Arctic Wolf has not identified. The w3wp.exe process then wrote an ASPX web shell. The attackers read the application’s web.config file to obtain database credentials and copied files into a web-accessible folder.
Valid AWS Credentials of Unknown Origin
In the second path, the attackers already held valid AWS credentials. Arctic Wolf does not know how they obtained them. The report treats the source of those credentials as an open question.
Attackers Enumerated AWS Through Valid IAM Users
Once inside AWS, the attackers used valid IAM users and sometimes assumed EC2 roles. They made hundreds of API requests in about 30 minutes. Most of the requests were blocked, but some succeeded in obtaining production secrets.
S3 Objects Read, Copied and Deleted
In one case, the attackers read, copied and deleted S3 objects. The deletion step goes beyond data theft and affects the victim’s stored data.
The pace of the activity, hundreds of calls in roughly half an hour, matches the way the report describes the agentic tooling: a platform that chains web exploitation, cloud enumeration and secret theft with less manual effort. Arctic Wolf’s analysis, as relayed by BleepingComputer, The Hacker News and Security Affairs, frames AntiFox as lowering the effort needed to link those stages together.
Report Includes Hunting Guidance, Dates Remain Vague
Arctic Wolf’s report includes hunting guidance and recommendations for defenders. The sources reviewed do not reproduce those details in full.
Two gaps limit what the public record shows. The report does not say when the intrusions took place beyond calling them recent, and it does not name the IIS vulnerability or explain where the AWS credentials came from. Dark Reading’s coverage was not accessible at the time of reporting.
The findings add to a short but growing set of cases in which open-source agentic security tools appear in real attacks. AntiFox began as a pentest framework forked from ARTEX, and its use against production environments shows how dual-use tooling can move from testing to intrusion. The attackers’ limited success rate, with most API requests blocked, indicates that access controls on the AWS accounts still stopped much of the activity, while the requests that succeeded were enough to reach production secrets.
Sources and Unanswered Questions in the Arctic Wolf Report
BleepingComputer, The Hacker News and Security Affairs all reported on the Arctic Wolf findings on November 11. The reports agree on the ASPX web shell written by w3wp.exe, the use of web.config database credentials and the 30-minute burst of AWS API requests.
The sources leave several matters open, including the unidentified IIS vulnerability, the origin of the valid AWS credentials and the exact intrusion dates. Arctic Wolf’s report describes the activity as recent without further specifics, and the editorial note attached to the research flags that recency should be confirmed before treating the intrusions as current.
The platform’s statistics provide limited context. With 251 forks and 474 stars on a fork of ARTEX 0.1.1, AntiFox is a small open-source project, yet the report shows it hosted on Alibaba Cloud systems and connected to live attacks against production environments.
