[Digital Today reporter Chi-gyu Hwang (황치규)] The AI-based penetration testing platform Antifox was used in attacks that stole Amazon Web Services (AWS) credentials and pushed into internal systems, The Hacker News reported on Nov. 11 (local time).

According to the report, security firm Arctic Wolf Labs said in a report that Alibaba Cloud servers operating Antifox were linked to attacks targeting publicly exposed web services and AWS environments in several recent intrusion cases.

Antifox is an autonomous penetration testing platform that can be downloaded from GitHub. It is a multi-agent system made up of a planner, a worker and a main agent. It performs tasks from reconnaissance and attack-surface discovery to vulnerability exploitation and report writing. The project has so far recorded 251 forks and 474 stars.

According to Arctic Wolf, the initial intrusion path in some attacks was publicly exposed web server IIS applications.

A web shell is a remote-control file that an attacker secretly plants on a server. ASPX is a web page format used in IIS, so an "ASPX web shell" refers to a control file that looks like an ordinary web page. "Executed operating system commands" means the attacker used the file to issue commands directly to the server computer.

The attackers created an ASPX web shell as an IIS worker process and executed operating system commands. A web shell is a remote-control file that an attacker secretly plants on a server, and ASPX is a web page format used in IIS.

Using this, the attackers searched for configuration files and backups and read application settings and database connection strings. With credentials extracted from the settings, they also tried to access internal operational databases. The vulnerability used to execute code on the IIS server was not identified.

In other attacks, the attackers began the intrusion with valid AWS credentials whose path of exposure was not identified. The attackers probed dozens of services, including IAM, EC2, S3, Lambda, Secrets Manager and Amazon Bedrock. Most API requests ended with access denied errors, but some reconnaissance and access to secrets succeeded. The Hacker News reported that there were cases in which requests to retrieve secret values for production environments were successful.

Arctic Wolf explained that such agentic frameworks make it easier for threat actors to access penetration testing techniques and increase the speed and consistency with which they apply those techniques in real attacks.

Attacks abusing the AI penetration testing tool Artex are also increasing. Check Point Research reported that operators often only set targets and leave the work to agents.