AntiFox-Linked Activity: IIS Web Shells, Misuse of Stolen AWS Credentials, Secret Retrieval, and S3 Operations

1. Basic Information

• Article: 2026-11-10: Antifox Agentic Pentesting Platform Used to Steal AWS Credentials and Move Laterally in Compromised Environments
• Publisher: Arctic Wolf Labs
• Publication Date: 2026-11-10
• Collection Date: 2026-11-12T07:30:45+09:00
• Original: Arctic Wolf Labs
• Related Sources: BleepingComputer: Hackers use AntiFox AI agents in AWS credential theft attacks
• Related Malware: ASPX Web Shell
• Related Threat Groups: None
• Related CVEs: None
• Related Products and Technologies: AntiFox, Microsoft IIS, AWS IAM, AWS Secrets Manager, Amazon S3
• Severity: Critical
• Basis for Severity: Confirmed compromises of public web services and successful retrieval of AWS production secrets, along with observed API operations on S3 objects.

2. Executive Summary

Arctic Wolf observed activities associated with AntiFox from infrastructure hosted on Alibaba Cloud, involving the placement of ASPX web shells on compromised IIS servers and the use of valid AWS credentials to interact with Secrets Manager and S3. A direct link between these two activities has not been confirmed in individual cases.

3. Attack Flow

Public reports present IIS-related activities and AWS-related activities as separate observations. It remains unconfirmed in individual cases whether credentials extracted from configuration files were used for the AWS operations. The pathways are outlined separately below.

IIS Compromise and Configuration File Parsing

1. An attacker gains access to an internet-facing web service. The initial vulnerability has not been identified.
2. An ASPX web shell is deployed from the IIS worker process to execute OS commands.
3. The web.config and database connection strings are parsed. Public reports indicate that the extracted credentials were used to attempt internal database connections, but their use in obtaining AWS privileges has not been established.

Pathway to Secrets Manager

1. The attacker uses a valid IAM user or an assumed EC2 role. The method used to obtain these credentials varies by case and includes unconfirmed instances.
2. The attacker enumerates AWS IAM and services, and retrieves production secrets from Secrets Manager (successful GetSecretValue calls are explicitly documented).

Pathway to S3

1. The attacker uses a valid IAM user or an assumed EC2 role, observed as an activity separate from the Secrets Manager pathway.
2. The attacker performs GetObject, CopyObject, and DeleteObject API operations on S3 objects. The success or failure of individual operations is not explicitly specified in the public reporting.

4. Attacker Position and Execution Location

• The attacker is remote and can reach internet-facing web services. AWS-side activity uses valid IAM credentials or an assumed EC2 role; how those credentials were obtained remains unconfirmed in some cases.

5. Perspective of Victims and Administrators

Victim Perspective

• Credentials and cloud data can be manipulated in the background even while the web service user interface appears normal.

Administrator Perspective

• Indicators include suspicious child processes of w3wp.exe, creation of ASPX files, copying of configuration files, and rapid mass enumeration and S3 operations within CloudTrail.

6. Success and Failure Conditions

Success Conditions

• Successful intrusion into a public web service and code execution with IIS privileges.
• For AWS activities, the attacker possesses valid AWS credentials (IAM user or assumed role) authorized for the targeted operations (acquisition methods vary by case).
• The AWS identity used by the attacker must have permission to perform the targeted Secrets Manager or S3 operations.

Failure Conditions and Mitigations

• Update and isolate web services, and restrict upload and execution paths.
• Avoid storing long-term AWS keys on web servers, and apply the principle of least privilege to EC2 roles.
• Deny GetSecretValue and targeted S3 operations to compromised identities (separate production secrets and S3 deletion permissions via distinct access controls and approval workflows). Auditing should be implemented as a separate detection control.

7. Impact of Successful Exploitation

• Command execution on IIS servers and persistent access via web shells.
• Retrieval of AWS production secrets.
• Retrieval, copying, and deletion of S3 objects.

8. Observable Logs

• Email: No email-specific vector has been publicly reported for this campaign.
• Proxy/SWG/DNS: Correlate traffic originating from the infrastructure IPs 47[.]79[.]4[.]33 and 8[.]208[.]101[.]210 using IIS access logs and CloudTrail. TCP/8787 is listed as a common port for AntiFox infrastructure, but it is not necessarily the port used in the observed intrusion traffic. Because these IP addresses may be shared or reassigned, IP matches alone are insufficient for attribution.
• Endpoint/EDR: Shells spawned by w3wp.exe, creation of ASPX files, parsing of web.config, and copying of configuration files or logs to web-accessible directories.
• Identity/IdP: Sources of IAM users or assumed roles, sequences of failed and successful authentications, and unusual regions or user agents.
• SaaS/Cloud: CloudTrail events including GetSecretValue, GetObject, CopyObject, DeleteObject, along with rapid mass enumeration.
• Network: Inference: Outbound egress from web servers to unknown destinations. Outbound traffic from compromised servers to the attacker infrastructure is not documented as an observed fact in public reports.

9. Assessing Attack Success

Initial Execution Confirmed

• Public Information: Creation of ASPX web shells and command execution by the IIS worker process were confirmed.
• Scope of Confirmation: Compromised web services investigated by Arctic Wolf.

Information Theft or Session Compromise Confirmed

• Public Information: Successful GetSecretValue calls targeting production secrets were explicitly reported.
• Scope of Confirmation: AWS identities and resources observed within Arctic Wolf telemetry (Secrets Manager pathway).

S3 API Operations Observed; Individual Outcomes Unconfirmed

• Public Information: API operations on S3 objects were observed, though the success or failure of individual actions is not explicitly stated in public reports.
• Scope of Confirmation: AWS identities and resources observed within Arctic Wolf telemetry (S3 pathway).

10. Investigation Playbook

• Trigger: IIS web shells, w3wp.exe child processes, and CloudTrail events such as GetSecretValue or S3 deletions.
• Initial Review: Determine the initial anomaly timestamp for the web service, ASPX diffs, credential sources, and AWS identities and resources involved.
• Endpoint: Preserve IIS process trees, file timelines, memory dumps, web logs, and configuration file access records.
• Identity and Cloud: Verify IAM access keys, assumed roles, sessions, and Secrets Manager resource policies.
• Subsequent Activity: Track S3 object histories, destination paths, deletion logs, database access, and the creation of additional accounts.
• Containment: Isolate hosts, remove web shells, revoke credentials, rotate secrets, restore S3 data, and rebuild hosts if necessary.
• Classification: Distinguish between web-only compromises, successful AWS authentication, secret retrieval, and S3 data manipulation.

11. Defense and Detection Ideas

• Single Events: Execution of cmd or PowerShell from w3wp.exe, CloudTrail GetSecretValue, or S3 DeleteObject.
• Timeline Correlation: Correlate web shell creation, configuration file reading, IAM enumeration, secret retrieval, and S3 operations by identity and timestamp.
• Hunting Perspective: Search for AntiFox interface IOCs, TCP/8787 traffic, added ASPX files, and configuration or log files copied to web-accessible directories.
• Log Gaps: Integrate IIS and CloudTrail timestamps and identities into a unified timeline, and identify S3 buckets lacking data events.
• Priority Actions: Reduce cloud privileges on web servers, secure Secrets Manager resource policies, and enable S3 data events and versioning.

12. Facts, Inference, and Hypothesis

Facts

• Arctic Wolf identified the AntiFox interface across two IP addresses on Alibaba Cloud and observed malicious operations linked to the same infrastructure across multiple web services and AWS environments.
• On compromised IIS servers, w3wp.exe created ASPX web shells, executed commands, and parsed web.config and database connection strings.
• AWS APIs were rapidly enumerated using valid IAM users or assumed EC2 roles, resulting in successful GetSecretValue calls for production secrets.
• GetObject, CopyObject, and DeleteObject API operations were observed in S3. Public reports do not specify the success or failure of individual operations or the scope of data retrieved or deleted.
• The vulnerability used for the initial intrusion into IIS was not identified in public reports.

Inference

• Whether the agentic capabilities of AntiFox autonomously executed each step cannot be definitively established from telemetry alone and should be evaluated based on the alignment of related infrastructure and operations.

Hypothesis

• None

13. MITRE ATT&CK Mapping

14. Gaps and Further Investigation

• Initial IIS intrusion vectors, the number of impacted organizations, the degree of manual operator involvement with AntiFox, the contents of deleted objects, and the relationship between credentials extracted from configuration files and AWS-side activities remain undisclosed.

15. Impact on SOCs and Organizations

To prevent web application compromises from spilling over into the cloud control plane, organizations must review AWS credentials stored in configuration files, EC2 role permissions, and the auditing settings of Secrets Manager and S3 in a unified manner.

16. Summary by Audience

• For SOCs: Track IIS child processes, web shells, configuration file access, AWS enumeration, GetSecretValue calls, and S3 operations by identity and timestamp.
• For Administrators: Isolate IIS servers, revoke AWS credentials, and review IAM permissions for least privilege, S3 versioning settings, and egress controls.
• For Users: This attack does not rely on typical user interaction. Follow credential update and service outage guidance provided by administrators.