{"id":"CMP-202611-tkdwyb","kind":"campaign","aliases":[],"related":[],"title":"Attackers use AntiFox, an AI hacking tool forked from ARTEX, to plant web shells on IIS servers, take AWS keys from web.config and steal AWS secrets and S3 data (Arctic Wolf)","description":null,"summary":"Arctic Wolf Labs reports real intrusions driven by AntiFox, an open-source Chinese-language AI-agent pentest framework forked from ARTEX v0.1.1, run from infrastructure on Alibaba Cloud. On exposed Microsoft IIS servers, w3wp.exe dropped an ASPX web shell. The attacker then read web.config connection strings and app settings and tried to reach an internal database with a stolen credential. The IIS flaw used to get in is unknown. In other cases the attacker started with a valid AWS credential obtained in an unknown way. With valid IAM users or an assumed EC2 role, it sent hundreds of List/Get/Describe calls across IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, EKS, Bedrock and other services in about 30 minutes. In at least one case this led to a successful GetSecretValue on a production secret, plus S3 GetObject, CopyObject and DeleteObject. Victims and start date unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-11T15:22:29+00:00","products":[{"name":"Microsoft IIS","fixed":[],"ecosystem":"vendor"},{"name":"AWS IAM","fixed":[],"ecosystem":"vendor"},{"name":"AWS Secrets Manager","fixed":[],"ecosystem":"vendor"},{"name":"Amazon S3","fixed":[],"ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"IIS: w3wp.exe spawning cmd.exe, powershell.exe, whoami.exe or icacls.exe. New .aspx files in web-writable folders. Copies of web.config or log files saved under changed extensions in web-reachable folders. PowerShell that reads web.config through .NET configuration classes. AWS CloudTrail: one source IP using several access keys, IAM users or assumed roles in a short time. Fast bursts of List/Get/Describe calls across unrelated services (GetCallerIdentity, ListUsers, ListRoles, ListPolicies, ListKeys, ecr:GetAuthorizationToken) with many AccessDenied errors. Boto3/Botocore user agents from hosting or ASN ranges (such as Alibaba Cloud) that the identity has not used before. A successful secretsmanager:GetSecretValue, or S3 CopyObject/DeleteObject, from unfamiliar infrastructure. Arctic Wolf's summary gives no specific IPs (unknown).","fix":"Isolate any IIS server with a web shell. Revoke and rotate the AWS keys and sessions, and every credential found in web.config, deployment files, logs and environment variables. Replace long-term IAM access keys in app configs with short-lived role credentials and least privilege. Turn on CloudTrail management events and S3 data events for sensitive buckets, plus S3 versioning and Object Lock where it fits. Alert on GetSecretValue from unfamiliar networks. Do not treat a burst of mostly denied calls as a failed attack.","status":"open","published_at":null,"first_seen_at":"2026-11-11T15:22:29+00:00","triaged_at":"2026-11-11T15:22:29+00:00","updated_at":"2026-11-11T15:24:16+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-11T15:27:33Z","path":"unknown","entry":"stolen-credential","reason":"In the AWS cases the attacker started with a valid AWS credential that still worked, though the record says it was obtained in an unknown way, and the IIS entry flaw is also unknown, so the entry classification is uncertain.","confidence":0.5}},"analyst_status":"done","analyst_note":null,"search":"'-202611':33A '30':167B 'across':151B 'agent':66B 'ai':5A,65B 'ai-ag':64B 'alibaba':77B 'amazon':42A 'antifox':3A,56B 'app':98B 'arctic':30A,48B 'artex':10A,71B 'aspx':87B 'assum':142B 'attack':1A,91B,124B 'aw':19A,25A,129B 'aws':37A,39A 'bedrock':161B 'call':150B 'campaign':44B 'case':122B,173B 'chines':62B 'chinese-languag':61B 'cloud':78B 'cmp':32A 'connect':95B 'copyobject':187B 'credenti':110B,130B 'data':29A 'databas':106B 'date':193B 'deleteobject':189B 'driven':54B 'drop':85B 'earli':46B 'early-warn':45B 'ec2':143B,153B 'ek':160B 'expos':80B 'flaw':113B 'fork':8A,69B 'framework':68B 'get':116B 'getobject':186B 'getsecretvalu':179B 'hack':6A 'hundr':147B 'iam':38A,138B,152B 'ii':16A,82B,112B 'iis':36A 'infrastructur':75B 'intern':105B 'intrus':53B 'key':20A 'kms':158B 'lab':50B 'lambda':155B 'languag':63B 'least':171B 'led':175B 'list/get/describe':149B 'manag':157B 'manager':41A 'microsoft':35A,81B 'minut':168B 'obtain':131B 'one':172B 'open':59B 'open-sourc':58B 'pentest':67B 'plant':12A 'plus':184B 'product':182B 'rds':159B 'reach':103B 'read':93B 'real':52B 'report':51B 'role':144B 'run':73B 's3':28A,43A,154B,185B 'secret':26A,156B,183B 'secrets':40A 'sent':146B 'server':17A,83B 'servic':164B 'set':99B 'shell':14A,89B 'sourc':60B 'start':125B,192B 'steal':24A 'stolen':109B 'string':96B 'success':178B 'take':18A 'tkdwyb':34A 'tool':7A 'tri':101B 'unknown':119B,134B,194B 'use':2A,114B 'user':139B 'v0.1.1':72B 'valid':128B,137B 'victim':190B 'w3wp.exe':84B 'warn':47B 'way':135B 'web':13A,88B 'web.config':22A,94B 'wolf':31A,49B","nicknames":["AntiFox"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["amazons3","antifox","awsiam","awssecretsmanager","iam","iis","microsoftiis","s3","secretsmanager"],"ptokens":["amazon","aws","iam","iis","manager","microsoft","s3","secrets"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"breach","search_a":"'-202611':33A 'ai':5A 'amazon':42A 'antifox':3A 'arctic':30A 'artex':10A 'attack':1A 'aw':19A,25A 'aws':37A,39A 'cmp':32A 'data':29A 'fork':8A 'hack':6A 'iam':38A 'ii':16A 'iis':36A 'key':20A 'manager':41A 'microsoft':35A 'plant':12A 's3':28A,43A 'secret':26A 'secrets':40A 'server':17A 'shell':14A 'steal':24A 'take':18A 'tkdwyb':34A 'tool':7A 'use':2A 'web':13A 'web.config':22A 'wolf':31A","search_b":"'30':167B 'across':151B 'agent':66B 'ai':65B 'ai-ag':64B 'alibaba':77B 'antifox':56B 'app':98B 'arctic':48B 'artex':71B 'aspx':87B 'assum':142B 'attack':91B,124B 'aw':129B 'bedrock':161B 'call':150B 'campaign':44B 'case':122B,173B 'chines':62B 'chinese-languag':61B 'cloud':78B 'connect':95B 'copyobject':187B 'credenti':110B,130B 'databas':106B 'date':193B 'deleteobject':189B 'driven':54B 'drop':85B 'earli':46B 'early-warn':45B 'ec2':143B,153B 'ek':160B 'expos':80B 'flaw':113B 'fork':69B 'framework':68B 'get':116B 'getobject':186B 'getsecretvalu':179B 'hundr':147B 'iam':138B,152B 'ii':82B,112B 'infrastructur':75B 'intern':105B 'intrus':53B 'kms':158B 'lab':50B 'lambda':155B 'languag':63B 'least':171B 'led':175B 'list/get/describe':149B 'manag':157B 'microsoft':81B 'minut':168B 'obtain':131B 'one':172B 'open':59B 'open-sourc':58B 'pentest':67B 'plus':184B 'product':182B 'rds':159B 'reach':103B 'read':93B 'real':52B 'report':51B 'role':144B 'run':73B 's3':154B,185B 'secret':156B,183B 'sent':146B 'server':83B 'servic':164B 'set':99B 'shell':89B 'sourc':60B 'start':125B,192B 'stolen':109B 'string':96B 'success':178B 'tri':101B 'unknown':119B,134B,194B 'use':114B 'user':139B 'v0.1.1':72B 'valid':128B,137B 'victim':190B 'w3wp.exe':84B 'warn':47B 'way':135B 'web':88B 'web.config':94B 'wolf':49B","search_c":"","cause_entry":"stolen-credential","cause_path":"unknown","disclosures_checked_at":"2026-11-11T15:30:00+00:00","first_public_at":"2026-11-11T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-tkdwyb","url":"https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T15:22:29+00:00","fetched_at":"2026-11-11T15:22:29+00:00","note":null,"cites":["https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns"]}],"documents":[{"id":126465,"url":"https://x.com/BleepinComputer/status/2120535346232365135","title":"@BleepinComputer: Hackers use AntiFox AI agents in AWS credential-theft attacks\nhttps://t.co/7h9H0","kind":"post","source":"x","publisher":null,"text":"Hackers use AntiFox AI agents in AWS credential-theft attacks\nhttps://t.co/7h9H0jNcv4\n\nhttps://t.co/7h9H0jNcv4\n\nlikes 9 reposts 3","published_at":"2026-11-11T15:13:18+00:00","relation":"describes","confidence":null,"note":null},{"id":126479,"url":"https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns","title":"AntiFox tool drives IIS & AWS attacks, Arctic Wolf warns","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":"2026-11-11T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}