CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
Summary: CERT-In reported that an AI-assisted actor it tracks as Crafty Falcon is actively targeting Indian BFSI organizations, cryptocurrency exchanges and digital asset providers using autonomous offensive tools including ARTEX, PentAGI, Cairn and CyberStrikeAI, with attack infrastructure rotating IP addresses within hours to days. A backdoored ARTEX build, distributed as the tomicdd/artex Docker image and downloaded 9,000 times, adds a hidden verifyCaptcha() function that returns a root shell on an unauthenticated request to the login endpoint, and 62 internet-facing ARTEX consoles were found serving that build between November 2 and 4, 2026, out of 1,645 hosts running the console as of November 4.
Key Takeaway: A compromised ARTEX instance holds its targets' unpatched findings, live credentials, captured sessions and network position, and whoever holds the backdoor can quietly change what the agents do on the next run. Docker removed the backdoored images, but 637 GitHub repositories still point to them.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026