Arctic Wolf links the AI agent platform AntiFox to intrusions that stole AWS secrets

Security firm Arctic Wolf says systems hosted on Alibaba Cloud running AntiFox, an autonomous penetration testing platform based on AI agents, were associated with 'confirmed malicious actions' against internet-facing web services and Amazon Web Services (AWS) environments, according to the report covered by The Hacker News since November 11. AntiFox presents itself on GitHub as built on ARTEX, the agent system already cited in other intrusions.

According to Arctic Wolf, in some cases initial access came through a compromised IIS application, where the attackers created a web shell and searched for configuration files and database credentials; the vulnerability used is not known. In other attacks they started from a valid AWS credential obtained by means not yet determined.

The security firm says most requests to the AWS API were denied, but some succeeded, including a read of a production secret in Secrets Manager. GitGuardian, which summarises the report, specifies that in one of the intrusions hundreds of requests were generated in about 30 minutes.

Arctic Wolf has not identified the targeted organisations, and no victim has publicly confirmed the use of AntiFox. The claim that the attack was assisted by AI agents comes from the security firm, based on the infrastructure it links to the tool.

Developing story: Arctic Wolf's original report still needs to be opened, and a victim or a public body needs to confirm the intrusions and AntiFox's role.