--- id: "CMP-202611-tkdwyb" page: "https://infrastack.ai/live/CMP-202611-tkdwyb" kind: "campaign" aliases: [] title: "Attackers use AntiFox, an AI hacking tool forked from ARTEX, to plant web shells on IIS servers, take AWS keys from web.config and steal AWS secrets and S3 data (Arctic Wolf)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Microsoft IIS", "fixed": [], "ecosystem": "vendor"}, {"name": "AWS IAM", "fixed": [], "ecosystem": "vendor"}, {"name": "AWS Secrets Manager", "fixed": [], "ecosystem": "vendor"}, {"name": "Amazon S3", "fixed": [], "ecosystem": "vendor"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-11T15:22:29+00:00" updated_at: "2026-11-11T15:24:16+00:00" sources: [{"source": "analyst", "url": "https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns", "first_seen_at": "2026-11-11T15:22:29+00:00", "cites": ["https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns"]}] exploit_sources: [] --- # Attackers use AntiFox, an AI hacking tool forked from ARTEX, to plant web shells on IIS servers, take AWS keys from web.config and steal AWS secrets and S3 data (Arctic Wolf) Link for people: https://infrastack.ai/live/CMP-202611-tkdwyb (this .md is for agents) Arctic Wolf Labs reports real intrusions driven by AntiFox, an open-source Chinese-language AI-agent pentest framework forked from ARTEX v0.1.1, run from infrastructure on Alibaba Cloud. On exposed Microsoft IIS servers, w3wp.exe dropped an ASPX web shell. The attacker then read web.config connection strings and app settings and tried to reach an internal database with a stolen credential. The IIS flaw used to get in is unknown. In other cases the attacker started with a valid AWS credential obtained in an unknown way. With valid IAM users or an assumed EC2 role, it sent hundreds of List/Get/Describe calls across IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, EKS, Bedrock and other services in about 30 minutes. In at least one case this led to a successful GetSecretValue on a production secret, plus S3 GetObject, CopyObject and DeleteObject. Victims and start date unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Microsoft IIS affected range not listed fixed no fixed version listed - vendor:AWS IAM affected range not listed fixed no fixed version listed - vendor:AWS Secrets Manager affected range not listed fixed no fixed version listed - vendor:Amazon S3 affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a stolen credential that still worked (stolen-credential). In the AWS cases the attacker started with a valid AWS credential that still worked, though the record says it was obtained in an unknown way, and the IIS entry flaw is also unknown, so the entry classification is uncertain. How it reached others: not stated (unknown). So it does not happen to you: List your long-lived credentials (GitHub tokens, cloud keys, app and service-principal secrets, CI secrets) with their last rotation; rotate anything older than 90 days or without an owner, and set expiry where it is offered. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#stolen-credential ## How to check IIS: w3wp.exe spawning cmd.exe, powershell.exe, whoami.exe or icacls.exe. New .aspx files in web-writable folders. Copies of web.config or log files saved under changed extensions in web-reachable folders. PowerShell that reads web.config through .NET configuration classes. AWS CloudTrail: one source IP using several access keys, IAM users or assumed roles in a short time. Fast bursts of List/Get/Describe calls across unrelated services (GetCallerIdentity, ListUsers, ListRoles, ListPolicies, ListKeys, ecr:GetAuthorizationToken) with many AccessDenied errors. Boto3/Botocore user agents from hosting or ASN ranges (such as Alibaba Cloud) that the identity has not used before. A successful secretsmanager:GetSecretValue, or S3 CopyObject/DeleteObject, from unfamiliar infrastructure. Arctic Wolf's summary gives no specific IPs (unknown). ## Fix Isolate any IIS server with a web shell. Revoke and rotate the AWS keys and sessions, and every credential found in web.config, deployment files, logs and environment variables. Replace long-term IAM access keys in app configs with short-lived role credentials and least privilege. Turn on CloudTrail management events and S3 data events for sensitive buckets, plus S3 versioning and Object Lock where it fits. Alert on GetSecretValue from unfamiliar networks. Do not treat a burst of mostly denied calls as a failed attack. ## Timeline - 2026-11-11T15:22:29+00:00 analyst https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns ## Documents - [describes] @BleepinComputer: Hackers use AntiFox AI agents in AWS credential-theft attacks https://t.co/7h9H0 https://x.com/BleepinComputer/status/2120535346232365135 - [describes] AntiFox tool drives IIS & AWS attacks, Arctic Wolf warns https://securitybrief.news/story/antifox-tool-drives-iis-aws-attacks-arctic-wolf-warns --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_