Following insights from Bleeping Computer, security researchers have identified a growing trend of attackers utilizing Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to compromise web services and Amazon Web Services environments.
AntiFox, which originated as a fork of ARTEX, enables users to deploy artificial intelligence agents to automate penetration testing tasks such as mapping services and identifying vulnerabilities. Arctic Wolf researchers observed that malicious actors are using these hosted platforms to perform credential validation, configuration discovery and the deployment of webshells on internet-exposed servers. In several documented intrusions, attackers utilized valid Identity and Access Management credentials and assumed Amazon Elastic Compute Cloud roles to execute authenticated requests against Amazon Web Services APIs. During one incident, an attacker cycled through multiple identities to perform hundreds of API requests within 30 minutes, successfully obtaining production secrets in some instances. Other malicious activities included reading, copying and deleting objects from Simple Storage Service buckets. While the developers of AntiFox prohibit its use for illegal activities, the platform lacks technical controls to enforce these restrictions. Security experts recommend that organizations correlate web server anomalies with unusual cloud access patterns and rotate any credentials exposed through application files to mitigate these automated threats.
Source: Bleeping Computer
