Arctic Wolf has observed attackers deploying the open-source agent-based penetration testing platform AntiFox from Alibaba Cloud. They used it to breach IIS web servers, test AWS credentials, and enumerate dozens of cloud services. In one instance, they read a production secret from Secrets Manager.
AntiFox is an open-source platform for agent-based penetration testing. It is designed to automate penetration tests, but Arctic Wolf has linked systems in Alibaba Cloud running AntiFox interfaces to confirmed malicious activities. These activities targeted web services accessible from the internet and the AWS environments behind them.
The attacks always followed the same chain: exploiting a web application, deploying a web shell, searching configuration files, validating credentials, and then scouring cloud services. According to Arctic Wolf, these types of frameworks make penetration testing techniques more accessible to malicious actors. They also allow these actors to apply those techniques more quickly and consistently.
From web shell to web.config
On a compromised IIS server, the w3wp.exe worker process created an ASPX web shell. Through that same process, the attacker then executed commands such as `whoami` and `icacls` to check permissions and test whether writing to the web root was possible. The vulnerability that enabled the code execution has not been identified.
Next came PowerShell. Using .NET configuration classes, the attacker read connection strings and application settings from web.config. Configuration and log files ended up in an upload folder accessible via the web. The attacker also attempted to connect to an internal production database using a stolen credential.
Hundreds of API calls in half an hour
In other cases, the attack began with a valid AWS credential, obtained by unknown means. The AntiFox infrastructure used IAM users and, at times, an assumed EC2 role. In one breach, the attacker switched between multiple identities and, within about half an hour, fired off hundreds of API requests to services including IAM, EC2, S3, Lambda, KMS, RDS, EKS, and Amazon Bedrock.
The vast majority returned an “AccessDenied” response. However, among those denials were successful operations, including a “GetSecretValue” request on a production secret. Elsewhere, an attacker performed S3 operations such as “GetObject,” “CopyObject,” and “DeleteObject.” Arctic Wolf therefore warns against assuming a series of requests has failed simply because most were denied.
Tip: Arctic Wolf: Psychedelic Stealer exploits CAPTCHA as an installer