Learn what Unit 42 discovered about attacker use of AI-powered red team tools, and how to mitigate these attacks. The post ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know appeared first on Unit 42.
Update 11/11/26: Added additional information from ConnectWise and Huntress. ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. As part of its investigation, ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, warning that they may be associated with the attacks. The campaign was first discovered Wednesday by cybersecurity firm Huntress, which says it has identified six compromised MSPs and 286 affected endpoints across 47 organizations, and that the number of victims continues to rise. "Our SOC is working an active campaign that started around 17:47 UTC today targeting cloud-hosted ScreenConnect instances," Huntress posted to Reddit.
Arctic Wolf saw attackers use the AntiFox pentest platform to hit IIS servers and AWS accounts. Arctic Wolf Labs has published research on attackers using AntiFox, an open-source, Chinese-language agentic penetration testing platform. These frameworks chain attack steps together with little human effort. In several intrusions, Alibaba Cloud systems hosting AntiFox interfaces were tied to confirmed attacks on internet-facing web services and the AWS environments behind them. Two entry points showed up. In some cases, the attackers got into a public IIS application, though Arctic Wolf couldn’t identify the vulnerability. In others, they started with a valid AWS credential obtained by means nobody knows. “Arctic Wolf is tracking the emerging use of self-hosted agentic penetration testing frameworks, including AntiFox, from public cloud infrastructure.” states the report published by Arctic Wolf, “In several recently observed intrusions, Alibaba Cloud systems hosting AntiFox interfaces were associated with confirmed malicious actions against internet-facing web services and associated AWS environments.” The IIS attacks followed a similar pattern. The IIS worker process, w3wp.exe, created an ASPX web shell and then ran commands to gather information about the system. The attackers checked the user account, listed files in the application folder, reviewed file permissions using icacls and tested whether they could write files to the website’s main folder. They then used PowerShell to read the web.config file, looking for database connection details and application settings. They also checked folders containing debug and error logs. Using credentials found in the configuration file, they tried to connect to an internal production database. Finally, they copied configuration files and logs into an upload folder that could be accessed through the website. The AWS attacks moved quickly. AntiFox used valid IAM accounts and, in some cases, an assumed EC2 role. The attackers first checked their identity and permissions within AWS. They used commands such as GetCallerIdentity, GetUser, ListUsers, ListRoles, ListPolicies and ListKeys to discover available accounts, roles, policies and access keys. They also tried to obtain an authorization token for Amazon Elastic Container Registry (ECR). In one intrusion, the source cycled through several AWS identities and sent hundreds of requests in about half an hour. “The activity then rapidly enumerated services across the affected AWS environments, including IAM, EC2, S3, Lambda, Secrets Manager, KMS, RDS, ECS, EKS, Redshift, Athena, Glue, Systems Manager, API Gateway, CloudWatch, CloudFormation, DynamoDB, and Amazon Bedrock, using List, Get, and Describe operations.” continues the report. “After authorization failures, the activity continued across other services and concentrated on resources that remained accessible.” Most requests came back as AccessDenied, but a few worked, and the attackers kept going where the doors were open. Some sequences ended with a successful GetSecretValue request against a production secret. Others focused on S3, listing buckets, objects and versions, reading objects, then copying and deleting them. Nobody has to stay awake for that kind of persistence, which is the whole point of the tool. Arctic Wolf’s concern is simple. These frameworks make penetration testing techniques easier to reach for attackers, and they make those techniques faster and more consistent in live attacks. For hunting, start with AWS activity coming from hosting providers the identity has never used. Look for one IP address using many access keys, users or roles in a short time, and for fast runs of List, Get and Describe calls across unrelated services, especially from Boto3 or Botocore. Check GuardDuty for odd IAM user behavior, credential access, discovery and unusual calls from hosting networks. On the Windows side, watch for w3wp.exe starting cmd.exe, powershell.exe, whoami.exe, icacls.exe or archive tools. Look for new .aspx files in upload, temporary and image-conversion folders, and for config or log files saved there under .txt or image extensions. PowerShell commands that read WebConfigurationManager, ConnectionStrings or AppSettings deserve a close look, and so does any AWS activity that starts soon after. Organizations should enable AWS CloudTrail logging and monitor access to sensitive S3 storage. They should also use S3 versioning and Object Lock to protect important data from deletion. Alerts should flag suspicious access to stored secrets, especially when it follows unusual account activity. Companies should identify all internet-facing applications and prioritize patching and protecting file upload, conversion and document-processing services. If an IIS process launches an unexpected command shell, administrators should isolate the server, preserve logs and forensic evidence, remove malicious files and change all exposed credentials. They should also revoke compromised AWS sessions and access keys, enforce IMDSv2 and apply least-privilege permissions to limit what applications can access. As Arctic Wolf warns, a series of mostly denied requests does not mean the attack was unsuccessful. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI Pentest Tool AntiFox)
Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process. The new revocations bring the total number of affected intermediate CA certificates to 16, including eight previously compromised certificates whose private keys were so weak that anyone could recover them almost instantly. In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025. HSMs are devices designed to securely generate and store cryptographic keys, preventing sensitive private keys from being exposed outside the hardware.
Notion, the digital workspace platform, disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed Notion AI chat transcripts in a small number of workspaces. The disclosure comes shortly after Fireworks AI confirmed that an attacker accessed its development environment via a third-party cloud provider on October 23 and compromised resource metadata, billing information, model weights, and datasets for some customers. Fireworks AI experienced another breach in early October, when hackers accessed environment variables containing API keys and tokens stored as secrets for a limited number of accounts. Notion learned about the exposed chat transcripts after receiving an alert from Fireworks on November 2 about an exposed dataset that contained only synthetic test data.
Maersk confirms a data breach involving a legacy system, while WhiteArmor claims 100GB of stolen data and demands a $5 million ransom. A.P. Moller Maersk, the Danish shipping giant, says it identified an IT security incident involving unauthorized access and data extraction from one of its local legacy systems, one inherited from a previous acquisition. “Maersk has identified an IT security incident involving unauthorised access and data extraction from one of our local legacy systems from a previous acquisition.” reads the statement published by Maersk on November 11. “Our findings so far strongly suggest no sensitive data has been disclosed. The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI.” According to Maersk, its cyber security team started a full investigation as soon as it found the problem, and it’s still going. The company says swift action secured the affected system. Its findings so far strongly suggest no sensitive data has been disclosed, and it says the incident is isolated to that one local system. Maersk has found no sign that other Maersk systems were affected, or the customer and partner systems that connect to it through integrations such as APIs and EDI. It doesn’t expect disruption for customers, who can book and manage shipments as usual. It promises updates and says it will inform any affected parties if it finds a need to. Maersk didn’t name the system, the type of data or the date of the intrusion. However, the cybercrime group WhiteArmor added the company to its Tor data leak site: WhiteArmor demanded a $5 million ransom in Bitcoin, giving Maersk 30 days to pay. The group claims to have stolen about 100 GB of data from the OCF/LF Logistics platform, which supports logistics and supply chain operations. “”Your contract-logistics arm, the former LF Logistics, runs fulfilment for many of the world’s largest consumer brands,” states the leak site. “Five million dollars is roughly four hours of that EBITDA.”” Maersk acquired LF Logistics, the company that developed the platform, from the Li & Fung Group in 2022. This could match Maersk’s reference to an old system inherited through an acquisition, although the company has not confirmed this connection. According to the attackers, the stolen data includes nearly 30,000 driver records, passwords stored in plain text, 33 super admin accounts and signed delivery receipts. The group also claims to have stolen inventory records, purchase orders, advance shipping notices and 27,842 mobile device logs containing phone numbers, email addresses and IMEI numbers. These details come from the attackers and have not been independently verified. Maersk’s statement does not confirm their claims. WhiteArmor also tried to justify its demand, saying the $5 million ransom represents roughly four hours of revenue for the logistics business. “We do not anticipate disruption to operations for customers at this time, and customers can continue to use Maersk platforms to book and manage their shipments as usual.” concludes the statement. “We will keep customers updated as more relevant information becomes available, and if we identify any need to inform impacted parties of any further findings, we will do so.” The scale of Maersk’s operations explains why this incident matters. A.P. Moller-Maersk is one of the world’s largest integrated shipping and logistics companies, playing a major role in global trade and supply chains. It operates around 700 container ships, representing approximately 13.5% of global container fleet capacity, and manages 60 terminals across 35 countries. The company employs about 100,000 people in 130 countries and provides services covering ocean shipping, port operations, warehousing, customs clearance and end-to-end supply chain management. Maersk reported approximately $54 billion in revenue and $2.9 billion in net profit in 2025. Its global reach and reliance on interconnected IT systems make cybersecurity a major concern. A breach involving even an older, locally operated platform could expose sensitive business and personal information, including data belonging to drivers, customers and logistics partners, even if the company’s main systems remain unaffected. In 2017, NotPetya forced the company to reinstall more than 4,000 servers and 45,000 workstations from scratch. It operated without IT for ten days and took damages of up to $300 million. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ransomware)
Shipping giant Maersk has confirmed that a threat actor breached systems belonging to a company it previously acquired and stole data. Ransomware group WhiteArmor claimed the attack over the weekend, threatening that it would release about 100GB of information allegedly exfiltrated from the company's logistics and supply-chain platform. The investigation into the incident is ongoing, but the shipping firm says that current evidence indicates that "no sensitive data has been disclosed." Maersk added that it does not expect disruptions to operations, and assures customers that they can continue booking and managing shipments through its systems as usual. “The incident is isolated to a local system, and we have found no indication that there has been any impact on other Maersk systems or customer and partner systems that connect to Maersk through integrations such as APIs and EDI,” Maersk states.
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. The infrastructure hosting AntiFox was used for various malicious activities, including vulnerability exploitation, webshell deployment, credential validation, configuration discovery, and AWS secret harvesting. Initially created as a fork of ARTEX 0.1.1, AntiFox has a Chinese-language interface and lets users deploy AI agents and automate common penetration-testing tasks, such as mapping exposed services and probing target endpoints for vulnerabilities. Security researchers at Arctic Wolf observed malicious AntiFox-linked infrastructure hosted on Alibaba Cloud using valid AWS identities, including IAM users and, in some cases, assumed EC2 roles, to make authenticated requests to Amazon Web Services APIs.
Linux eBPF rootkits can hide malicious activity and evade traditional detection methods without loading kernel modules. Flare reveals how these techniques are spreading through underground forums, where threat actors are sharing rootkit source code, tutorials, and exploits targeting Linux systems.
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. This follows N-able's decision to take all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions until it could patch them against potential attacks targeting the zero-day flaws in the wild. "N-able is actively responding to non-responsible communication of critical vulnerabilities in N-central late Sunday night, November 8, found by an independent researcher," N-able told BleepingComputer on Monday. "As a precautionary measure, we took our Hosted N-central environment offline today, November 9, and provided guidance to customers operating on-premises N-central servers to temporarily take their servers offline until further notice."
Confirm this action.
Leaving now will discard your changes.