CompTIAAvailable
CS0-003
CERT-In AI Attacks: Backdoored ARTEX Exposes 62 Consoles
CERT-In says an AI-assisted actor, Crafty Falcon, is attacking Indian BFSI organizations with tools like ARTEX. A copycat ARTEX Docker image hides an unauthenticated root shell, and 62 consoles served it in early November 2026.
Short answer: CERT-In says Crafty Falcon is actively using AI-driven offensive tools against Indian BFSI organizations. Separately, a copycat ARTEX Docker image (`tomicdd/artex`) hides an unauthenticated root shell. If you ever pulled it, stop the container and rotate every credential it held.
CERT-In says an AI-assisted threat actor it tracks as Crafty Falcon is actively attacking Banking, Financial Services, and Insurance (BFSI) organizations in India. Separately, a copycat of the ARTEX tool on Docker Hub hides an unauthenticated root shell. If you ever ran tomicdd/artex, treat that host as compromised.
This post covers both stories, who should worry, and the exact commands to check your systems. Details come from The Hacker News report.
What CERT-In says Crafty Falcon is doing
CERT-In calls the threat active and ongoing. The actor uses publicly available AI-driven offensive tools such as ARTEX, PentAGI, Cairn, and CyberStrikeAI.
According to CERT-In, these tools "execute complete attack chains autonomously at machine speed" and adapt payloads based on how targets respond. The supporting infrastructure rotates IP addresses within hours to days. Attacks also hit cryptocurrency exchanges and digital asset service providers, resulting in stolen keys and funds.
CERT-In's earlier October 2026 alert lists the initial access routes:
Stolen long-lived static or hard-coded API tokens
Supply chain compromise of source code repositories through forged commits
Plaintext credentials in configuration files, source code, or databases
Applications and remote services without multi-factor authentication (MFA)
After getting in, attackers invoke fund-transfer APIs from the victim's own allow-listed infrastructure. They run micro-value test transactions (such as Rs. 1) before large transfers, delete logs, and tamper with endpoint security tools.
The backdoored ARTEX image
ARTEX's developer took the repository off GitHub after real-world abuse. Copies appeared to fill the gap, including github.com/trhhubsd/ARTEXX, github.com/mhtsec/ARTEX, and github.com/RuoJi6/ARTEX. The first two are no longer available for download.
The trhhubsd/ARTEX copy was starred 2,449 times and forked over 600 times. It changed a single line in docker-compose.yml so it pulls the tomicdd/artex image from Docker Hub. That image has been downloaded 9,000 times.
Researcher Badbyte says the image adds a hidden verifyCaptcha() function to the login handler. If the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned. This happens before any credential check, so every install has an unauthenticated root shell.
Who is affected
You are affected if you pulled or ran one of these images:
Image or source | Status in the report |
|---|---|
| Backdoored |
| Backdoored, identical to |
| Listed as other "artex" namespaces; not described as backdoored |
| Its |
The report gives no version numbers or fixed release. The safe move is to remove the image, not wait for a patch.
The scale is visible too. Between November 2 and 4, 2026, 62 internet-facing ARTEX consoles served the backdoored build. The first appeared by October 20, 2026, twelve days after the image was pushed. Of those, 26 are in the U.S., 17 in Hong Kong, and seven in China. In total, 1,645 hosts served an ARTEX console as of November 4.
How serious it is
It is serious, and the exposure is live. The 62 consoles were reachable from the internet, and a root shell needs no password.
The researcher explains the damage: a compromised ARTEX instance holds its targets' unpatched findings, live credentials, captured sessions, and network position. Whoever holds the backdoor can also quietly change what the agents do on the next run.
So the victim is not only the person running the tool. Every organization that person tested may be exposed too. The report does not say who is exploiting the backdoor. Check the linked article for updates.
What to do now
Work through these steps in order.
Find any ARTEX containers and images on your hosts.
Stop and remove anything from the backdoored namespaces.
Rotate every credential, token, and key the instance could reach.
Review the host for signs of unwanted access.
Find it
docker ps -a --format '{{.Names}}\t{{.Image}}\t{{.Status}}' | grep -i artex
docker images --format '{{.Repository}}:{{.Tag}}\t{{.ID}}' | grep -i artex
grep -rn "artex" --include=docker-compose.yml --include=docker-compose.yaml ~/ 2>/dev/nullCheck whether the console is reachable from outside:
docker port <container>
ss -tlnp | grep -i dockerRemove it
docker stop <container> && docker rm <container>
docker rmi tomicdd/artex congdonglinux/artexIf the host was internet-facing, do not just delete the container. Rebuild the host from a clean image, since the attacker had root.
Rotate and review
Rotate every API key, cloud credential, and session token the ARTEX instance stored or could reach.
Review the engagement data it held. Tell any clients whose findings or credentials were inside.
Check web server and container logs for odd POST requests to the login endpoint:
docker logs <container> 2>&1 | grep -i loginThe marker is secret, so a clean grep proves nothing. Treat exposure as the trigger, not log evidence.
Use CERT-In's list for your own estate
If you run BFSI or fintech systems, test your own exposure against the October vectors. Remove hard-coded tokens, move plaintext credentials into a secrets manager, and enforce MFA on remote services. Assume attackers will reverse-engineer your mobile app, so do not rely on "only our client calls this API." Our write-up on a malicious file that tries to trick an AI coding agent shows a related risk with AI tooling.
What learners can take from this
Two lessons stand out. First, offensive tools are software supply chain targets like any other. Pin images by digest, read compose files, and review diffs against the upstream project. Second, AI speeds up attackers but the entry points are old: static tokens, plaintext secrets, and missing MFA.
CERT-In also published Artificial Intelligence Security Auditing Guidelines. They call for testing an AI agent's identities, permission boundaries, and least privilege, plus human approval for consequential actions. If incident handling is your path, the INE Certified Incident Responder (ECIR) voucher ($234.99) covers triage and response skills. More options are in our Cybersecurity certifications category.
Vouchers are emailed within 12 hours of payment.
Sources
Questions about this topic
Is ARTEX itself malicious?
No. ARTEX is described as an open-source AI-driven penetration testing tool. The problem is a copycat build that pulls the `tomicdd/artex` Docker image with a hidden root shell. Real attackers also misuse legitimate tools like it, which prompted the developer to remove the original repository.
Can the backdoor be exploited without a password?
Yes. The hidden `verifyCaptcha()` function runs commands as root when the CAPTCHA field starts with a secret marker. This happens before any credential check, so no login is needed.
I only used the original ARTEX build. Do I need to act?
The backdoor is described in the `tomicdd/artex` image and its identical copy `congdonglinux/artex`. Still, confirm which image your compose file pulls. If it names either namespace, remove it and rotate credentials.
Why does the Rs. 1 transaction matter in CERT-In's alert?
CERT-In says attackers run micro-value test transactions to validate unauthorized fund flows before sending large transfers. Alerting on tiny, unusual payments from API endpoints can give you an early warning.
How can I avoid pulling a tampered image in future?
Compare your `docker-compose.yml` against the upstream project, and pull only from the maintainer's official namespace. Pin images by digest rather than a tag. Avoid exposing tool consoles to the internet.
