Arctic Wolf Links AntiFox on Alibaba Cloud Servers to AWS Intrusions

Security firm Arctic Wolf Labs reported that Alibaba Cloud servers running the AntiFox AI penetration-testing platform were used in intrusions targeting publicly exposed web services and Amazon Web Services environments, according to The Hacker News, which reported the findings on the 11th local time.

AntiFox is an autonomous penetration-testing platform that can be downloaded from GitHub and is built as a multi-agent system with a planner, workers and a main agent. According to Arctic Wolf Labs, the platform was running on Alibaba Cloud infrastructure used in the attacks.

In some of the intrusions, the initial entry point was publicly exposed IIS web applications, where attackers created an ASPX webshell through the IIS worker process and executed operating system commands. The attackers used configuration files and backups to read application settings and database connection strings, and attempted to connect to an internal operational database. No vulnerability used to execute code on the IIS server was identified.

In other attacks, the intruders started with valid AWS credentials whose path was not disclosed, and probed dozens of services including IAM, EC2, S3, Lambda, Secrets Manager and Amazon Bedrock. Most API requests ended in access-denied errors, but some probing and access to secrets succeeded, including a request that retrieved production secret values.

Other AI testing tools in use

Separately, Check Point Research said operators abusing the AI penetration-testing tool ARTEX often only set a goal and delegate tasks to agents. AntiFox has been available on GitHub for some time, where the project has recorded 251 forks and 474 stars.