---
title: Attackers run AntiFox, an open-source AI pentesting agent, from Alibaba Cloud to go from IIS web shells to AWS production secrets | ctxsec
url: https://ctxsec.com/items/arctic-wolf-antifox-agentic-pentest-platform-alibaba-cloud-iis-web-shells-aws-secrets
description: "Arctic Wolf Labs says Alibaba Cloud hosts running AntiFox, an open-source Chinese-language agentic pentesting platform, were tied to confirmed malicious activity against internet-facing web services and the AWS accounts behind them. On a compromised IIS server, w3wp.exe dropped an ASPX web shell and read web.config connection strings. With valid IAM users and an assumed EC2 role, the activity made hundreds of cross-service API calls in about half an hour; most were denied, but it reached a successful GetSecretValue on a production secret and, elsewhere, read, copied and deleted S3 objects."
status: "vendor research (Arctic Wolf Labs pack alert, Nov 10, 2026)"
published: 2026-11-11
---

> Arctic Wolf Labs says Alibaba Cloud hosts running AntiFox, an open-source Chinese-language agentic pentesting platform, were tied to confirmed malicious activity against internet-facing web services and the AWS accounts behind them. On a compromised IIS server, w3wp.exe dropped an ASPX web shell and read web.config connection strings. With valid IAM users and an assumed EC2 role, the activity made hundreds of cross-service API calls in about half an hour; most were denied, but it reached a successful GetSecretValue on a production secret and, elsewhere, read, copied and deleted S3 objects.

[← AI](/ai) · [markdown](/items/arctic-wolf-antifox-agentic-pentest-platform-alibaba-cloud-iis-web-shells-aws-secrets.md)

vendor research (Arctic Wolf Labs pack alert, Nov 10, 2026)

2026-11-11 11:37 AM ET

### Attackers run AntiFox, an open-source AI pentesting agent, from Alibaba Cloud to go from IIS web shells to AWS production secrets

- **Why it matters:** Arctic Wolf says agentic frameworks make pentest techniques more accessible to attackers and apply them faster and more consistently. AntiFox joins ARTEX-style tools already seen in the wild.
- **Hunt:** AWS API calls from hosting ASNs new to an identity; one IP using several access keys or roles in a short window; fast List/Get/Describe sweeps across unrelated services from Boto3/Botocore (don't assume failure because most were denied); `w3wp.exe` spawning `cmd`, `powershell`, `whoami`, `icacls`; new `.aspx` files in upload or temp folders; PowerShell using `WebConfigurationManager` or `ConnectionStrings`.
- **Indicators:** 47.79.4[.]33, 8.208.101[.]210; console title 'AntiFox — 自主渗透测试控制台'. Arctic Wolf notes cloud IPs may be reassigned.
- **Fix:** alert on GetSecretValue from novel infrastructure, enable CloudTrail and S3 data events with versioning, enforce IMDSv2, rotate anything stored in web.config, and cut broad List permissions from app identities.

Sources: [Arctic Wolf Labs pack alert: AntiFox agentic pentesting platform used to steal AWS credentials (Nov 10, 2026)](https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions) · [Arctic Wolf on X (Nov 10, 2026)](https://x.com/AWNetworks/status/2120197246880760222)