# AntiFox agentic AI pentest platform (ARTEX fork) abused in IIS webshell to AWS credential-theft intrusions

> Attackers are running self-managed instances of AntiFox, an open-source agentic penetration-testing platform forked from ARTEX 0.1.1 and hosted on Alibaba Cloud, to compromise internet-facing IIS servers, deploy ASPX webshells, harvest configuration data and AWS secrets, and then make authenticated AWS API calls with valid IAM users and assumed EC2 roles. A separate intrusion used a valid AWS identity to read, copy and delete S3 objects. Arctic Wolf reported the activity; no named actor is attributed.

- **Published:** 2026-11-11T15:36:12Z
- **Last reviewed:** 2026-11-11T15:36:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5777
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5777.png
- **ID:** TL-2026-5777
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (3 shown free below)

## Description

Arctic Wolf Labs (report dated 2026-11-10, reported by BleepingComputer on 2026-11-11) documented intrusions in which threat actors operated self-managed AntiFox instances on Alibaba Cloud infrastructure. AntiFox is an AGPL-3.0, Go/Next.js multi-agent autonomous penetration-testing platform with a Chinese-language UI (web console title 'AntiFox - autonomous pentest console', default web UI port TCP/8787). Its README describes a planner, worker agents and a main human-interaction agent, a dual-graph (global asset graph plus per-task exploration graph) design, MITM traffic recording, MCP/Skill extensions and automatic report generation. It is a secondary development of ARTEX starting at v0.1.1; the project's stated terms prohibit use against live systems, but no technical control enforces this.

In the web-to-cloud intrusion chain, the AntiFox-linked infrastructure exploited an internet-exposed IIS server and deployed an ASPX webshell into a web-accessible upload directory. Through w3wp.exe the actor spawned cmd.exe, powershell.exe and where.exe, ran whoami and icacls to check execution context and write permissions, and tested writes to the web root. PowerShell/.NET code using System.Web.Configuration.WebConfigurationManager, WebConfigurationFileMap, VirtualDirectoryMapping, ConnectionStrings and AppSettings was used to read application settings and database connection strings, and configuration and log files were copied to the web-accessible directory (files matching pwn*.aspx, cfg*.txt, wc*.txt, el*.txt) for retrieval.

Harvested AWS secrets were then used from AntiFox-linked source IPs (47.79.4.33, 8.208.101.210) with Boto3/Botocore 1.43.125 user agents. In one intrusion the actor cycled through several identities and issued hundreds of API requests in about 30 minutes; most were denied but some succeeded and exposed production secrets (ListSecrets then GetSecretValue). Observed sequences include GetCallerIdentity then ListBuckets, ListBuckets then ListObjects, and ListObjects then HeadObject/GetObject. The actor also enumerated IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, SSM, API Gateway, CloudWatch, CloudFormation, DynamoDB and Bedrock, and attempted ECR GetAuthorizationToken. In a separate incident a valid AWS identity was used to read, copy (CopyObject) and delete (DeleteObject) S3 objects.

Context: ARTEX was published to GitHub in July 2026, went closed-source on 2026-10-08 after more than 12,000 forks, and has been abused by other actors (CrowdStrike's VAPOR PANDA against 200+ organizations from 2026-10-17; Wiz/Microsoft Storm-0940 in October 2026). Those campaigns are related tooling context only; Arctic Wolf does not attribute the AntiFox activity to any named actor. The report cautions that IP-based indicators may be reassigned and are unreliable over time. Defenders should correlate IIS webshell activity with unusual AWS access, review successful API calls inside bursts of denied calls, revoke affected sessions and keys, and rotate credentials exposed through application files.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.004 Valid Accounts: Cloud Accounts
- T1505.003 Server Software Component: Web Shell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1033 System Owner/User Discovery
- T1087.004 Account Discovery: Cloud Account
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1619 Cloud Storage Object Discovery
- T1222.001 Windows Permissions
- T1552.001 Unsecured Credentials: Credentials In Files
- T1530 Data from Cloud Storage
- T1485 Data Destruction
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1588.002 Obtain Capabilities: Tool

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**IIS w3wp.exe Spawning cmd/PowerShell - AntiFox ASPX Webshell Execution** (`TL-2026-5777-SPL-001`)

Detects the IIS worker process w3wp.exe spawning cmd.exe, powershell.exe or pwsh.exe. In the AntiFox (ARTEX fork) web-to-cloud intrusions reported by Arctic Wolf, an ASPX webshell on an exploited IIS server was driven through w3wp.exe to run shells for discovery and AWS-secret harvesting. IIS worker processes rarely launch interpreters in normal operation, so this is a high-fidelity exploitation and webshell-execution signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003, T1059.003, T1059.001
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\w3wp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
| eval child=lower(replace(Image, "^.*\\\\", ""))
```AntiFox webshell pattern: IIS worker process spawning a command shell```
| stats count min(_time) as first_seen max(_time) as last_seen dc(child) as distinct_children values(child) as children values(CommandLine) as command_lines by host, User, ParentCommandLine
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table first_seen last_seen host User ParentCommandLine children distinct_children count command_lines
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: IIS Worker Process w3wp.exe Spawning Command Shell - AntiFox ASPX Webshell
id: 5777a001-0001-4a11-9e11-000000005777
status: experimental
description: Detects the IIS worker process w3wp.exe spawning cmd.exe, powershell.exe or pwsh.exe, the execution pattern observed when AntiFox-operated infrastructure deployed an ASPX webshell on an internet-facing IIS server (Arctic Wolf, TL-2026-5777).
references:
  - https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions
  - https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
  - attack.tool.antifox
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate web applications that shell out to cmd.exe or PowerShell for maintenance tasks
  - Application deployment or health-check scripts launched by the application pool
level: high

```

**Known false positives:**

- Legitimate web applications or CMS plugins that invoke cmd.exe or PowerShell from the application pool
- Deployment, health-check or backup scripts triggered via IIS applications

**Tuning notes:** Baseline w3wp.exe children per host for 14 days and exclude known application pools by ParentCommandLine (-ap value) plus expected CommandLine patterns. Keep alerting unconditionally on powershell.exe/pwsh.exe children and on any child whose command line contains whoami, icacls, WebConfigurationManager or file writes into upload directories. Requires Sysmon EventCode 1 with ParentImage collected on IIS servers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ASPX Webshell Creation in IIS Upload Directory - AntiFox [indicator] (locked: unlock with TL Creds)
- Config and Log Staging Files cfg*/wc*/[indicator] in IIS Web Directory - AntiFox (locked: unlock with TL Creds)
- AWS Secrets Manager and S3 Enumeration-to-Read Sequences - AntiFox Cloud Collection (locked: unlock with TL Creds)
- Webshell Discovery - whoami/icacls/where.exe Under w3wp.exe and icacls on Web Root (locked: unlock with TL Creds)
- IIS Traffic From AntiFox Infrastructure or Requests to [indicator] and Staged TXT Files (locked: unlock with TL Creds)
- S3 Object Copy and Deletion by Valid AWS Identity - AntiFox Collection and Destruction (locked: unlock with TL Creds)
- PowerShell WebConfigurationManager Config and Connection-String Theft - AntiFox Post-Exploitation (locked: unlock with TL Creds)
- AWS CloudTrail Enumeration From AntiFox-Linked IPs or Boto3 1.43.125 With Denied-Call Burst (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 15)

Defanged, TLP:CLEAR.

- IP address: `47.79.4[.]33`
- File hash: `c370d03542ed2ec696f7337940b14652e98e9bab`
- IP address: `8.208.101[.]210`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BleepingComputer: Hackers use AntiFox AI agents in AWS credential-theft attacks](https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks/)
- [Arctic Wolf: Antifox Agentic Pentesting Platform Used to Steal AWS Credentials and Move Laterally in Compromised Environments](https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions)
- [AntiFox-AI/antifox GitHub repository](https://github.com/AntiFox-AI/antifox)
- [Wiz: ARTEX in the Wild - Storm-0940 Expands Targeting of IT and Software Vendors](https://wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)
- [BleepingComputer: Chinese hackers use ARTEX AI in automated attacks against 200 orgs](https://bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs)
- [SOCRadar: ARTEX AI pentest tool - what security teams need to know](https://socradar.io/blog/artex-ai-pentest-tool-what-security-teams-need-to-know/)
- [jwatte: How ARTEX Works - A Defender's Guide to Agentic Attacks](https://jwatte.com/blog/how-artex-agentic-pentest-framework-works-defense.md)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5777