Researchers have linked Alibaba Cloud systems hosting self-managed AntiFox interfaces to intrusions targeting internet-facing web services and Amazon Web Services (AWS) environments. Arctic Wolf Labs said the activity included web exploitation, ASPX web-shell deployment, credential validation and cloud-service enumeration, with some intrusions reaching production secrets. The researchers’ incident report was also examined in BleepingComputer’s November 11 report.
AntiFox is an open-source, multi-agent penetration-testing platform that automates reconnaissance, attack-surface discovery, exploitation and reporting. Its GitHub project says it was developed from ARTEX 0.1.1 and prohibits use against live systems. The platform builds on the same framework family involved in ARTEX deployments exposed online.
In one intrusion, attackers used an exposed Microsoft Internet Information Services (IIS) application to deploy an ASPX web shell through the w3wp.exe worker process. They then ran operating-system commands, inspected application settings and database connection strings, searched log directories and copied configuration files into a web-accessible directory. Arctic Wolf said it could not identify the vulnerability used to compromise the IIS application.
Separately, Arctic Wolf observed attackers using valid AWS IAM identities, obtained through an unknown method, to enumerate services including IAM, EC2, S3, Lambda, Secrets Manager and KMS. Most API requests were denied, but some discovery and secret-access operations succeeded. In at least one case, an attacker made a successful GetSecretValue request against a production secret. In another, a valid AWS identity was used to discover S3 resources and perform object operations.
Amazon told BleepingComputer that AWS services were not compromised and operated as designed. The company said the attackers used credentials taken from customers’ compromised applications to access their AWS accounts. Arctic Wolf did not identify how the credentials were first stolen or who operated the AntiFox-hosting systems. The use of cloud identities to reach customer environments echoes the Qubole AWS access incident.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
