Arctic Wolf links AntiFox-hosting systems to attacks that retrieved an AWS production secret

Attackers reached a production secret in Amazon Web Services during intrusions linked to systems hosting AntiFox, an AI-driven security-testing platform, Arctic Wolf Labs found. Its investigation, covered by The Hacker News on November 11, connects malicious web and cloud activity to that infrastructure—not to an identified operator of the tool.

Arctic Wolf associated Alibaba Cloud systems hosting AntiFox interfaces with confirmed malicious actions against public-facing web services and related AWS environments. That infrastructure link is the core finding; it should not be read as identifying who ran AntiFox or proving that every observed action was autonomous.

AntiFox is available on GitHub. Its maintainer describes a system of planning and worker agents that takes an authorized security assessment from reconnaissance through exploitation, evidence collection and report delivery. The software is presented as a penetration-testing platform—a tool for checking systems for weaknesses with permission.

A compromised web application opened the search

Some initial access involved a compromised application running on Internet Information Services, Microsoft’s web-server software. The IIS worker process, w3wp.exe, created an ASPX web shell: a server-side file that lets an attacker issue commands. Command execution through that same process suggested entry through the affected application. The vulnerability that enabled it remains unknown.

Once inside, commands checked the execution identity, explored the application directory, inspected permissions and tested whether files could be written into the web root. The activity then turned toward configuration data and credentials. Arctic Wolf described these steps:

• PowerShell commands located web.config files and configuration backups, while other commands read application settings and database connection strings.
• The attackers examined debug and error-log directories and copied configuration and log files into a web-accessible upload directory.
• A credential extracted from application configuration was used to attempt a connection to an internal production database. That was an attempt, not a confirmed database breach.

Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks

Arctic Wolf Labs, quoted by The Hacker News

Permission denials did not stop every request

Other attacks began with a valid AWS credential obtained by unknown means. The attackers used valid cloud identities to check credentials and explore dozens of services, including storage, computing, databases and Secrets Manager. Most authenticated requests across those services returned AccessDenied errors, but some discovery and secret-access operations succeeded.

The clearest confirmed result went beyond listing available secrets. Arctic Wolf observed a successful GetSecretValue request against a production secret in AWS Secrets Manager. Elsewhere in the investigation, a valid AWS identity was used for S3 storage discovery and object operations.

GitGuardian’s account of the same investigation adds a measure of pace: hundreds of AWS API requests in approximately 30 minutes during one intrusion. That figure describes requests, not hundreds of successful accesses. Its account draws on Arctic Wolf’s findings rather than a separate investigation confirming the intrusions.

Cleanup has to remove the access

For defenders, GitGuardian recommends checking AWS CloudTrail logs for successful calls buried within bursts of denied requests, especially access to Secrets Manager. It also recommends revoking affected sessions and access keys, rotating credentials exposed in application settings, and investigating whether those credentials opened additional resources.

Rotating credentials used by production applications requires coordination to avoid unnecessary outages, GitGuardian cautions. Deleting a compromised file or removing an exposed secret does not invalidate the credential. Access remains available until the credential is revoked, rotated or otherwise made unusable.