L3 · ShartedAntiFox · IIS · AWS · credentialsantifox-iis-aws-intrusions

AntiFox-linked intrusions used IIS web shells and valid AWS credentials

Arctic Wolf Labs linked AntiFox-hosting infrastructure to intrusions involving internet-facing IIS applications and AWS customer accounts. Investigators observed successful access to a production secret and, in separate activity, S3 object reads, copies and deletions.

Disclosed: Nov 10, 2026; Public disclosure date
Severity: Sharted; No CVE: a breach, not a bug
Splash zone: Compromised internet-facing IIS applications and AWS customer accounts accessed with valid IAM credentials or role sessions.; AntiFox · IIS · AWS · credentials
In the wild: Yes; Arctic Wolf observed live intrusions and successful AWS API calls.

What happened

Arctic Wolf observed an IIS worker write an ASPX web shell and run commands that extracted application settings and database connection strings. The initial IIS vulnerability is unknown. In other activity the attacker started with a valid AWS credential whose origin was unknown. The cloud actions occurred inside customer environments using existing AWS identities. The researchers did not identify a victim count or attribute every action to an AI agent.

Crime-scene timeline

Nov 10, 16:41 UTC
Arctic Wolf Labs publishes its findings
The report links AntiFox-hosting infrastructure to IIS web shell activity and authenticated AWS API abuse.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Arctic Wolf Labs original reportPrimaryDocuments observed IIS and AWS activity, scope limits, indicators and containment steps.
AWS IAM role session revocationPrimaryOfficial procedure to revoke active IAM role sessions.

Wipe guide

The wipe checklist

0 of 4 sheets used

Isolate affected IIS servers and preserve evidenceIf w3wp.exe spawns unexpected shells or writes ASPX files, isolate the server. Preserve IIS and endpoint logs, the web root and memory where feasible. Review writable upload and temporary directories and restore the application from a trusted build after containing the entry point.
Revoke exposed AWS credentials and sessionsDisable exposed access keys and revoke affected role sessions. Review CloudTrail activity for each affected IAM user and role before issuing replacement credentials. Rotate the database passwords, API tokens and other secrets exposed through application settings, backup files or logs. Update dependent workloads and verify access with least-privilege replacement credentials.
Correlate the published hunting indicatorsArctic Wolf lists network, banner, process, file, API and user-agent indicators. Published infrastructure and identifiers include 47[.]79[.]4[.]33 · 8[.]208[.]101[.]210 · TCP/8787 · c370d03542ed2ec696f7337940b14652e98e9bab · AntiFox — 自主渗透测试控制台 · Boto3/1.43.125 · Botocore/1.43.125. Use the full list in the report. In EDR, look for unexpected child processes of w3wp.exe and new ASPX files in writable upload paths. In CloudTrail, find successful GetSecretValue or S3 object calls within bursts of denials and correlate timestamps with IIS activity. A match alone does not establish compromise.
Verify S3 changes and improve loggingFor buckets with S3 data events enabled, compare GetObject, CopyObject and DeleteObject with expected workload behavior. Check object versions and restore affected objects from verified copies if required. Enable CloudTrail management events and relevant S3 data events, and use GuardDuty to monitor anomalous identity activity.

AntiFox-linked intrusions used IIS web shells and valid AWS credentials

What happened

Crime-scene timeline

Who said what

Other turds from around the same time