Arctic Wolf Labs details incidents linking the AI security platform AntiFox to attacks against web services and AWS environments.
The report covers initial access vectors involving compromised public-facing web applications and valid AWS credentials acquired through unknown means.
The AntiFox platform and suspicious actions
The platform is called AntiFox and is freely available online as a tool that promises to automate security checks. According to cybersecurity firm Arctic Wolf Labs, hosting systems connected to the platform were found to be behind malicious actions. However, the researchers point out that using the platform does not necessarily prove who was behind the keyboards.
How they got into companies' systems
In one set of incidents, the breach began with publicly accessible web applications. The attackers searched for configuration files and log histories, copied them to publicly accessible folders, and attempted to connect directly to internal databases using the credentials they found. So far, researchers have not identified exactly which security flaw allowed the initial entry.
In other attacks, the attackers used valid credentials for cloud services, without it being known how they obtained them. They attempted to gain access to dozens of different services, and while most attempts were thwarted, some were successful. In at least a few cases, the attackers were able to read stored secrets and browse companies’ digital files.
Why are experts worried?
Arctic Wolf notes that the emergence of artificial intelligence tools that automate such processes can make attacks faster and easier, even for people with less technical knowledge.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Cynet blocks attack on Qlik Sense systems of its customers in the European Union
↗
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
