IIS web shells carried AntiFox-linked attacks into AWS
Arctic Wolf Labs linked several intrusions to Alibaba Cloud systems hosting AntiFox, an AI-driven penetration-testing platform, after observing attacks on internet-facing web services that reached associated AWS environments. The researchers reported access to production secrets and storage.
On compromised Microsoft Internet Information Services (IIS) servers, attackers used a web shell—a remotely accessible command interface—running through the IIS worker process to read application configuration and logs. Those files can contain database connection strings and credentials; the reported activity then used valid AWS credentials to enumerate cloud services and reach secrets and storage. AWS did not have to be the initial point of entry.
If an IIS application can read credentials trusted by AWS, removing the shell or fixing the entry point does not make copied credentials stop working. The exposure can persist in the cloud account and its reachable production data, even after the server appears clean; the reporting does not establish whether every accessed resource was exfiltrated.
Hackers use AntiFox AI agents in AWS credential-theft attacks
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments.