AntiFox agentic AI pentest platform (ARTEX fork) abused in IIS webshell to AWS credential-theft intrusions

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5777 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: IIS w3wp.exe Spawning cmd/PowerShell - AntiFox ASPX Webshell Execution

Detects the IIS worker process w3wp.exe spawning cmd.exe, powershell.exe or pwsh.exe. In the AntiFox (ARTEX fork) web-to-cloud intrusions reported by Arctic Wolf, an ASPX webshell on an exploited IIS server was driven through w3wp.exe to run shells for discovery and AWS-secret harvesting. IIS worker processes rarely launch interpreters in normal operation, so this is a high-fidelity exploitation and webshell-execution signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003, T1059.003, T1059.001
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
| eval child=lower(replace(Image, "^.*\\\\", ""))
```AntiFox webshell pattern: IIS worker process spawning a command shell```
| stats count min(_time) as first_seen max(_time) as last_seen dc(child) as distinct_children values(child) as children values(CommandLine) as command_lines by host, User, ParentCommandLine
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentCommandLine children distinct_children count command_lines

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, SHA256
| order by Timestamp desc

Sigma

title: IIS Worker Process w3wp.exe Spawning Command Shell - AntiFox ASPX Webshell
id: 5777a001-0001-4a11-9e11-000000005777
status: experimental
description: Detects the IIS worker process w3wp.exe spawning cmd.exe, powershell.exe or pwsh.exe, the execution pattern observed when AntiFox-operated infrastructure deployed an ASPX webshell on an internet-facing IIS server (Arctic Wolf, TL-2026-5777).
references:
  - https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions
  - https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - attack.tool.antifox
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate web applications that shell out to cmd.exe or PowerShell for maintenance tasks
  - Application deployment or health-check scripts launched by the application pool
level: high

Known false positives:

• Legitimate web applications or CMS plugins that invoke cmd.exe or PowerShell from the application pool
• Deployment, health-check or backup scripts triggered via IIS applications

Tuning notes: Baseline w3wp.exe children per host for 14 days and exclude known application pools by ParentCommandLine (-ap value) plus expected CommandLine patterns. Keep alerting unconditionally on powershell.exe/pwsh.exe children and on any child whose command line contains whoami, icacls, WebConfigurationManager or file writes into upload directories. Requires Sysmon EventCode 1 with ParentImage collected on IIS servers.

• 🔒 ASPX Webshell Creation in IIS Upload Directory - AntiFox [indicator] · unlock with TL Creds
• 🔒 Config and Log Staging Files cfg*/wc*/[indicator] in IIS Web Directory - AntiFox · unlock with TL Creds
• 🔒 AWS Secrets Manager and S3 Enumeration-to-Read Sequences - AntiFox Cloud Collection · unlock with TL Creds
• 🔒 Webshell Discovery - whoami/icacls/where.exe Under w3wp.exe and icacls on Web Root · unlock with TL Creds
• 🔒 IIS Traffic From AntiFox Infrastructure or Requests to [indicator] and Staged TXT Files · unlock with TL Creds
• 🔒 S3 Object Copy and Deletion by Valid AWS Identity - AntiFox Collection and Destruction · unlock with TL Creds
• 🔒 PowerShell WebConfigurationManager Config and Connection-String Theft - AntiFox Post-Exploitation · unlock with TL Creds
• 🔒 AWS CloudTrail Enumeration From AntiFox-Linked IPs or Boto3 1.43.125 With Denied-Call Burst · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5777.

Sample indicators (3 of 15)

• IP address: 47.79.4[.]33
• File hash: c370d03542ed2ec696f7337940b14652e98e9bab
• IP address: 8.208.101[.]210

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

Technical analysis

A separate intrusion used a valid AWS identity to read, copy and delete S3 objects. Arctic Wolf reported the activity; no named actor is attributed.

Arctic Wolf Labs (report dated 2026-11-10, reported by BleepingComputer on 2026-11-11) documented intrusions in which threat actors operated self-managed AntiFox instances on Alibaba Cloud infrastructure. AntiFox is an AGPL-3.0, Go/Next.js multi-agent autonomous penetration-testing platform with a Chinese-language UI (web console title 'AntiFox - autonomous pentest console', default web UI port TCP/8787). Its README describes a planner, worker agents and a main human-interaction agent, a dual-graph (global asset graph plus per-task exploration graph) design, MITM traffic recording, MCP/Skill extensions and automatic report generation. It is a secondary development of ARTEX starting at v0.1.1; the project's stated terms prohibit use against live systems, but no technical control enforces this.

In the web-to-cloud intrusion chain, the AntiFox-linked infrastructure exploited an internet-exposed IIS server and deployed an ASPX webshell into a web-accessible upload directory. Through w3wp.exe the actor spawned cmd.exe, powershell.exe and where.exe, ran whoami and icacls to check execution context and write permissions, and tested writes to the web root. PowerShell/.NET code using System.Web.Configuration.WebConfigurationManager, WebConfigurationFileMap, VirtualDirectoryMapping, ConnectionStrings and AppSettings was used to read application settings and database connection strings, and configuration and log files were copied to the web-accessible directory (files matching pwn*.aspx, cfg*.txt, wc*.txt, el*.txt) for retrieval.

Harvested AWS secrets were then used from AntiFox-linked source IPs (47.79.4.33, 8.208.101.210) with Boto3/Botocore 1.43.125 user agents. In one intrusion the actor cycled through several identities and issued hundreds of API requests in about 30 minutes; most were denied but some succeeded and exposed production secrets (ListSecrets then GetSecretValue). Observed sequences include GetCallerIdentity then ListBuckets, ListBuckets then ListObjects, and ListObjects then HeadObject/GetObject. The actor also enumerated IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, SSM, API Gateway, CloudWatch, CloudFormation, DynamoDB and Bedrock, and attempted ECR GetAuthorizationToken. In a separate incident a valid AWS identity was used to read, copy (CopyObject) and delete (DeleteObject) S3 objects.

Context: ARTEX was published to GitHub in July 2026, went closed-source on 2026-10-08 after more than 12,000 forks, and has been abused by other actors (CrowdStrike's VAPOR PANDA against 200+ organizations from 2026-10-17; Wiz/Microsoft Storm-0940 in October 2026). Those campaigns are related tooling context only; Arctic Wolf does not attribute the AntiFox activity to any named actor. The report cautions that IP-based indicators may be reassigned and are unreliable over time. Defenders should correlate IIS webshell activity with unusual AWS access, review successful API calls inside bursts of denied calls, revoke affected sessions and keys, and rotate credentials exposed through application files.

MITRE ATT&CK techniques by tactic:

Discovery

T1033 System Owner/User Discovery; T1087.004 Account Discovery: Cloud Account; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1619 Cloud Storage Object Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell

Initial Access

T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application

defense-impairment

T1222.001 Windows Permissions

Impact

T1485 Data Destruction

Persistence

T1505.003 Server Software Component: Web Shell

Collection

T1530 Data from Cloud Storage

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1583.003 Acquire Infrastructure: Virtual Private Server; T1588.002 Obtain Capabilities: Tool

Remediation

Patches

• Patch whatever vulnerability exposed the IIS application; Arctic Wolf did not name a CVE

Immediate actions

• Revoke affected AWS sessions and access keys and rotate any credentials, secrets and connection strings exposed in IIS application config files
• Hunt IIS hosts for w3wp.exe spawning cmd.exe, powershell.exe, where.exe, whoami.exe or icacls.exe and for pwn*.aspx, cfg*.txt, wc*.txt and el*.txt files in web-accessible upload directories
• Review CloudTrail for successful API calls inside bursts of AccessDenied calls, Boto3/Botocore 1.43.125 user agents, and the sequences ListSecrets/GetSecretValue and ListBuckets/ListObjects/GetObject
• Block or alert on traffic from 47.79.4.33 and 8.208.101.210 (may be reassigned)

Workarounds

• Restrict write access and script execution in web-accessible upload directories
• Place IIS-hosted applications behind a WAF and remove secrets from application settings in favor of a secrets manager with scoped access

Longer-term hardening

• Enforce least-privilege IAM and short-lived credentials; avoid long-lived IAM user keys on web servers
• Require IMDSv2 and restrict EC2 instance role permissions
• Enable S3 versioning, MFA Delete and object-level logging to detect and recover from delete/copy abuse
• Alert on web server worker processes spawning shells and on config reads via WebConfigurationManager

Affected and fixed versions

• Microsoft — Internet Information Services (IIS) internet-facing applications
  Vulnerable versions: Unspecified; exploited vulnerability not disclosed
• Amazon Web Services — IAM users and EC2 instance roles, Secrets Manager, S3
  Vulnerable versions: Environments with exposed long-lived or role credentials

Timeline

• 2026-07-01 ARTEX open-source agentic pentesting framework published to GitHub (July 2026, exact day not stated by Wiz); AntiFox later forked from ARTEX v0.1.1.
• 2026-10-08 ARTEX developer made the project closed-source after more than 12,000 forks; forks such as AntiFox remain public.
• 2026-10-17 CrowdStrike-tracked VAPOR PANDA began an 11-day ARTEX-driven campaign against 200+ organizations in 14 countries (related ARTEX abuse, not attributed to the AntiFox intrusions).
• 2026-10-22 Wiz published analysis of ARTEX abuse by Storm-0940 against IT and software vendors, following Microsoft's report on 2026-10-21.
• 2026-11-02 BleepingComputer reported CrowdStrike's findings on VAPOR PANDA's ARTEX use.
• 2026-11-10 Arctic Wolf Labs published 'Antifox Agentic Pentesting Platform Used to Steal AWS Credentials and Move Laterally' with hunting guidance and IOCs.
• 2026-11-11 BleepingComputer reported Arctic Wolf's findings on AntiFox-driven IIS webshell and AWS credential-theft intrusions.

Sources cited

• Arctic Wolf: Antifox Agentic Pentesting Platform Used to Steal AWS Credentials and Move Laterally in Compromised Environments GitHub · Research · 2026-11-10
• Wiz: ARTEX in the Wild - Storm-0940 Expands Targeting of IT and Software Vendors Wiz · Research · 2026-10-22
• AntiFox-AI/antifox GitHub repository GitHub · Code repository
• SOCRadar: ARTEX AI pentest tool - what security teams need to know socradar.io · Blog
• jwatte: How ARTEX Works - A Defender's Guide to Agentic Attacks jwatte.com · Blog
• BleepingComputer: Hackers use AntiFox AI agents in AWS credential-theft attacks BleepingComputer · News · 2026-11-11
• BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs BleepingComputer · News · 2026-11-02

More in cloud

• CVE-2026-109469 - Microsoft Entra Device Registration Elevation of Privilege (CVSS 10.0)
• Qubole Cross-Account Access Abused in the Wild: AWS Integration Role Assumption Campaign
• LLMjacking Bills Reach $1M (Mandiant/GTIG; LiteLLM CVE-2026-40217), Trezor Safe 5 Reseller Implant, SAP Flaws Weaponized Within Days
• Key Eater: Stolen Microsoft Entra ID Application Credentials Used to Breach 27 Organizations
• The Rise of LLMJacking: Threat Actors Monetize Compromised Cloud and Model Resources (UNC6993, D1337-KAIROS, CVE-2026-40217)