"In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments," Arctic Wolf Labs said.
AntiFox's design and public footprint
AntiFox is an open-source, agentic penetration testing platform described on its GitHub README as a "planner / worker / main-agent multi-agent system" that runs a full engagement over a "dual-graph core (a global asset graph + a per-task exploration graph)" — recon, attack-surface discovery, exploitation, finding capture, and report delivery. The project is publicly available on GitHub, where it had been forked 251 times and starred 474 times at the time of reporting.
Intrusion pattern observed by Arctic Wolf Labs
Arctic Wolf Labs linked AntiFox-hosting systems on Alibaba Cloud to intrusions that chained web exploitation and web shell deployment to extract configuration and credentials. In several incidents, the compromise began with an internet-facing Microsoft IIS application: attackers created an ASPX web shell through the IIS worker process, w3wp.exe, then executed operating-system commands to gather configuration and credential material.
- Commands run through w3wp.exe included PowerShell searches for web.config files and configuration backups, and reads of application settings and database connection strings.
- Investigations located debug and error-log directories, attempts to connect to internal production databases using extracted credentials, and copying of configuration and log files into web-accessible upload directories.
- Arctic Wolf noted specific reconnaissance commands such as whoami, directory enumeration, icacls permission checks, and writes to the web root to validate execution context and persistence options.
The precise vulnerability enabling code execution on the IIS servers was not determined in the incidents described; in other observed attacks the initial foothold came from a valid AWS credential obtained by means the report does not specify.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageAWS enumeration, cross-service API calls, and secret exfiltration
Once authenticated to AWS with a valid identity, the activity observed by Arctic Wolf included broad cross-service enumeration. Services targeted by API calls included IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock.
Arctic Wolf reported that while many authenticated requests returned "AccessDenied," some discovery and secret-access operations succeeded. In at least some instances activity progressed beyond Secrets Manager enumeration to a successful GetSecretValue request against a production secret. Separate activity used a valid AWS identity for S3 discovery and object operations via API calls.
Arctic Wolf summarized the operational consequence plainly: "Agentic frameworks such as these make penetration testing techniques more accessible to threat actors, while increasing the speed and consistency with which these techniques can be applied in live attacks."
Agentic frameworks at scale: ARTEX, Operation Ghost-Campus, and the broader ecosystem
The AntiFox incidents sit within a wider trend of open-source agentic attack frameworks that wire a language model into automated loops of tooling and action. The reporting cites about 45 such frameworks across five categories — end-to-end network kill chains, web-app and API tooling, C2-integrated frameworks, harnesses, and research prototypes — and names examples including ARTEX, PentAGI, Strix, Sage, RAPTOR, Incalmo, and others.
Check Point Research and Censys data referenced in the reporting show exposed ARTEX consoles in the wild: Censys counted 1,465 hosts running an exposed ARTEX console as of November 4, 2026, and Check Point identified 2,557 systems hosting ARTEX, including 10 misconfigured instances exposing full databases. CERT-EU warned that agentic tools increase scale, speed, and persistence, enabling the testing of large numbers of low-complexity misconfigurations and long attack chains without human fatigue.
The reporting also cites VECERT's disclosure of Operation Ghost-Campus, an agent-driven campaign that automated account creation, global scanning for misconfigured servers, extraction and validation of API keys for OpenAI and DeepSeek, and the subsequent misuse of stolen compute to maintain cost-free access to models and to harvest student data.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Arctic Wolf's account highlights concrete indicators to monitor — unexpected ASPX web shells, w3wp.exe spawning PowerShell activity that searches for web.config files and copies configuration artifacts into web roots, and unusual Secrets Manager GetSecretValue calls tied to enumerated IAM identities.
- Policymakers and regulators: Public count data from Censys and Check Point, and CERT-EU's warnings about scale and persistence, underscore a governance challenge: readily available agentic frameworks lower the technical barrier to large-scale automated attacks, raising questions about disclosure, responsible use, and controls for open-source offensive tooling.
- Affected enterprises and procurement leaders: The presence of accessible agentic tools such as AntiFox on GitHub — and evidence that they have been leveraged in operations that accessed production secrets — reinforces the need to validate third-party code, treat exposed consoles and misconfigurations as priority findings, and review Secrets Manager and S3 access patterns tied to IAM identities.
The record in this reporting is stark and specific: open-source agentic platforms are no longer theoretical tools for testers only — they are being paired with web exploitation and cloud API abuse to reach production secrets. Arctic Wolf's documented GetSecretValue success against a production secret is the proof-of-concept that defenders must treat as concrete; the next steps lie in detecting the precise IIS post-exploitation behaviors, hardening cloud identity and secrets controls, and addressing the proliferation of exposed agentic consoles.
