AntiFox, a Free AI Pentest Agent, Was Run From Alibaba Cloud Against IIS Servers and AWS Accounts. Arctic Wolf Saw It Reach a Production Secret. Two IPs Are in Our Feed
If you run IIS web applications that hold AWS keys, or AWS accounts with long-lived IAM user keys, check two things today. First, look for w3wp.exe, the IIS worker process, starting cmd.exe, powershell.exe, whoami.exe or icacls.exe, and for new .aspx files in upload folders. Second, look in CloudTrail for one source address using several access keys or roles in a short burst, mostly denied, with a successful GetSecretValue or S3 GetObject somewhere in the middle. Arctic Wolf Labs saw exactly that pattern from Alibaba Cloud hosts running AntiFox, a free, open-source AI penetration-testing platform. The two source IPs Arctic Wolf published are now in our feed.
What Arctic Wolf reported
The primary source is Arctic Wolf Labs' pack alert of November 10, 2026, published in Arctic Wolf's wolf-tools repository on GitHub. We read it directly. BleepingComputer and The Hacker News covered it on November 11; both link the same pack alert, so this is one source.
The tool. Arctic Wolf calls AntiFox "an open source, Chinese language agentic pentesting platform." Its own README says it is a fork of ARTEX, starting from ARTEX version 0.1.1, and that it runs a planner agent, worker agents and a main agent from reconnaissance to a finished report. The README says AntiFox "must not be used to perform actual testing against any online system or website." Nothing in the software enforces that.
The finding, in Arctic Wolf's words: "In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments."
The IIS half. On a compromised IIS server, "w3wp.exe created an ASPX web shell and spawned operating-system commands that located web.config files and configuration backups, read application settings and database connection strings, and copied configuration and log files into a web-accessible upload directory." The commands started with whoami and icacls, then PowerShell read the connection strings through the .NET configuration classes, and the attacker tried to log in to an internal production database with a password taken from the config. Arctic Wolf states plainly: "The exact vulnerability used for code execution was not identified."
The AWS half. Some intrusions started with a valid AWS credential "obtained through unknown means." The AntiFox-linked hosts used IAM users and, in some cases, an assumed EC2 role. In one intrusion the source "cycled through multiple AWS identities and generated hundreds of cross-service API requests within approximately half an hour." Arctic Wolf lists eighteen services touched, from IAM, EC2, S3 and Secrets Manager to Amazon Bedrock. "While many calls returned AccessDenied, successful operations were interspersed throughout the same sequences. Activity eventually progressed to a successful GetSecretValue request against a production secret." In other activity a valid identity listed S3 buckets and then read, copied and deleted objects.
How many victims. Arctic Wolf says "several" intrusions and does not give a count, a sector or a country.
What it means
Nothing here is a new exploit. Every step, from the web shell to the API burst, is a technique defenders already know. What changed is the cost: an AI agent runs the whole chain, keeps trying other AWS services after each denial, and stops on whatever works. Arctic Wolf's warning is the sentence to keep: "Do not assume a sequence was unsuccessful because most requests were denied." A wall of AccessDenied errors in CloudTrail is not a failed attack. The few calls that succeeded are the attack.
The second lesson is where the keys came from. The web server held database passwords, and possibly AWS keys, in web.config and log files. An attacker who gets a shell on the web server inherits every secret the application can read.
What to do
Hunt on IIS. Look for w3wp.exe starting cmd.exe, powershell.exe, where.exe, whoami.exe or icacls.exe. Look for new .aspx files written by w3wp.exe in upload, temporary or image-conversion folders. Arctic Wolf's file names to look for: pwn.aspx, and cfg.txt, wc.txt or el.txt copied into an upload folder.
Hunt in PowerShell logs for System.Web.Configuration.WebConfigurationManager, WebConfigurationFileMap, ConnectionStrings.ConnectionStrings, AppSettings.Settings or [IO.File]::ReadAllText.
Hunt in CloudTrail for one source IP using more than one access key, IAM user or role in a short window; for bursts of List, Get and Describe calls across unrelated services; for any successful GetSecretValue from a hosting provider the identity has never used; and for ListSecrets followed by GetSecretValue. Arctic Wolf saw the user agents Boto3/1.43.125 and Botocore/1.43.125.
Block or alert on the two published source IPs, 47.79.4.33 and 8.208.101.210. Arctic Wolf warns that cloud addresses "may be reassigned or shared with unrelated tenants," so treat a hit as a reason to look, and expect the attacker to move.
If you find any of this, isolate the web server, keep the web root, IIS logs and memory, then rotate every secret the application could read: database passwords, AWS keys, API tokens, and anything in web.config, environment variables, debug logs and backup configs. Revoke active AWS sessions for the affected identities and read their CloudTrail history before issuing new keys.
Reduce what a stolen key can do. Least-privilege policies so an application identity cannot list the whole account, IMDSv2 required with a low hop limit on EC2, CloudTrail data events on sensitive S3 buckets, and versioning or Object Lock on buckets you cannot afford to lose.
Look for AntiFox itself. Arctic Wolf gives its web title, "AntiFox — 自主渗透测试控制台" (Chinese for "autonomous penetration testing console"), and its usual port, TCP 8787. If you find an AntiFox console inside your own network that nobody approved, ask who started it.
What is not known
How the attackers got code execution on the IIS servers; Arctic Wolf did not identify it. How they got the first AWS credential. Who they are: Arctic Wolf names no actor. Whether the secrets read were used afterwards. How many organizations were hit. Whether AntiFox's own developers have any link to the attackers; nothing in the report says so, and anyone can download and host the tool.
How we know, and how we checked
We read Arctic Wolf's pack alert in full from GitHub, the AntiFox README, and both press reports. We tested nothing and hosted no AntiFox instance.
Our edge check: we scanned our own edge records from August 1 to today for the two published IPs (300,107 blocked requests, 115,064 decoy hits and 5,583 requests that reached our origin) and found none from either address. We scanned blocked requests since October 1 (268,386) for the Boto3/1.43.125 user agent, and the August-onward records for the pwn*.aspx and cfg/wc/el text-file paths, and found none. That is expected: we run no IIS and the AWS activity happens inside the victim's cloud account, where our edge cannot see it. A zero here says nothing about whether the campaign is active.
Our feed: before this post, neither IP was in our corpus. We added both, credited to Arctic Wolf, at confidence 80 under the source tag manual-batch-antifox-2026-11, and read both back afterwards. They are Arctic Wolf's indicators, not our observations. We did not add the banner hash, the port or the user-agent strings, because those identify the tool or a library, not one attacker, and blocking on them would catch legitimate AWS scripts and authorized testers.
Sources
Arctic Wolf Labs, "Antifox Agentic Pentesting Platform Used to Steal AWS Credentials and Move Laterally in Compromised Environments," pack alert dated November 10, 2026, github.com/rtkwlf/wolf-tools, folder pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions. AntiFox README, github.com/AntiFox-AI/antifox. BleepingComputer report by Bill Toulas, November 11, 2026. The Hacker News report by Ravie Lakshmanan, November 11, 2026.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Comments