CERT-In Warns of AI-Driven "Crafty Falcon" Attacks on Indian BFSI as Backdoored ARTEX Docker Images Expose Root Access on 62 Consoles
CERT-In has disclosed an active campaign by an AI-assisted threat actor tracked as Crafty Falcon, targeting Banking, Financial Services, and Insurance (BFSI) organizations, cryptocurrency exchanges, and digital asset providers in India. The actor leverages publicly available AI-driven offensive security tools — ARTEX, PentAGI, Cairn, and CyberStrikeAI — to autonomously execute full attack chains, generate tailored scripts, and rotate infrastructure IPs within hours. Separately, researcher Badbyte found that a popular GitHub fork of ARTEX (trhhubsd/ARTEXX, starred 2,449 times) was modified to pull a backdoored Docker image (tomicdd/artex, 9,000 downloads) that grants an unauthenticated root shell via a hidden verifyCaptcha() function triggered by a secret marker in the login's CAPTCHA field. As of November 4, 2026, 62 internet-facing ARTEX consoles (mostly in the US, Hong Kong, and China) were found running the backdoored build out of 1,645 total exposed ARTEX instances.
Entenda a falha
A vulnerabilidade
No CVE was assigned. This is a supply-chain backdoor in copies of the open-source AI pentesting tool ARTEX, not a coding bug. The GitHub fork trhhubsd/ARTEXX changed one line in docker-compose.yml to pull the Docker image tomicdd/artex (about 9,000 downloads). A near-identical image, congdonglinux/artex, is also backdoored. The image hides a routine in the login handler that gives an unauthenticated root shell. An attacker only needs network reach to the console's login endpoint, with no credentials or user interaction. As of November 4, 62 of 1,645 exposed ARTEX consoles served the backdoored build. The articles name no fixed version; the guidance is to verify image provenance.
Como funciona
A user deploys ARTEX from the modified compose file, which pulls the trojanized image from Docker Hub. The console listens on an open port and receives login requests. The hidden verifyCaptcha() function in the login handler inspects the CAPTCHA field. If the field starts with a secret marker, the rest of the value is run through sh -c as root and the output is returned in the response. This happens before any credential check, so the normal login logic never runs for that request.
Por que é vulnerável
The cause is deliberately planted malicious code, not an accident. The fork's author altered the deployment file to point to an attacker-controlled image, and that image adds a pre-authentication command-execution path that runs as root. Per the researcher, the backdoor never shows up in a code review because the change is in the Docker image, not in the repository's source. Running an unvetted attack tool as root on an open port made it worse.
Onde está
The hidden verifyCaptcha() function in the login handler of the tomicdd/artex image, plus the single changed line in docker-compose.yml of the trhhubsd/ARTEXX fork.
Como foi descoberta
The independent researcher Badbyte found the backdoor and shared the details with The Hacker News by email. According to the article, the image was pushed to Docker Hub about twelve days before the first backdoored console appeared online on October 20, 2026. Badbyte saw 62 backdoored consoles between November 2 and 4. The original ARTEX developer had taken the repository down after it was abused in real intrusions, and copies appeared to fill the gap. CERT-In's separate Crafty Falcon alert only mentions ARTEX among the tools used by the actor.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 08:16.
Detalhes técnicos
Crafty Falcon exploits internet-facing apps, exposed APIs, and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, then invokes fund-transfer APIs from within victims' own allow-listed infrastructure, bypassing KYC, sanction, and transaction-limit controls. Initial access vectors include stolen long-lived API tokens, supply-chain compromise via forged commits, plaintext credentials in config files/source code, and services lacking MFA. Post-exploitation actions include reverse-engineering codebases for tailored exploits, abusing modified app packages for unauthorized API calls, executing micro-value test transactions before large fraudulent transfers, abusing merchant settlement APIs, and exploiting file-upload and deserialization chains leading to PHP/Node.js web shells. Operators delete logs and tamper with EDR to hinder detection. On the ARTEX backdoor, the hidden routine runs attacker input through sh -c as root and returns output before any credential check, giving an unauthenticated root shell on every install; a nearly identical backdoored image exists under the congdonglinux/artex namespace.
Remediação
CERT-In has published AI Security Auditing Guidelines requiring documented AI agent identities, least-privilege enforcement, human approval for consequential actions, and emergency interruption/credential revocation controls. Organizations running ARTEX or similar pentesting tools should verify image provenance, avoid running such tools as root on exposed ports, enforce MFA, rotate API tokens, and audit configuration files and repositories for forged commits or hardcoded credentials.
Linha do tempo
-
CERT-In Warns of AI-Driven "Crafty Falcon" Attacks on Indian BFSI as Backdoored ARTEX Docker Images Expose Root Access on 62 Consoles
ler a análise desta fonte ocultar
CERT-In has disclosed an active campaign by an AI-assisted threat actor tracked as Crafty Falcon, targeting Banking, Financial Services, and Insurance (BFSI) organizations, cryptocurrency exchanges, and digital asset providers in India. The actor leverages publicly available AI-driven offensive security tools — ARTEX, PentAGI, Cairn, and CyberStrikeAI — to autonomously execute full attack chains, generate tailored scripts, and rotate infrastructure IPs within hours. Separately, researcher Badbyte found that a popular GitHub fork of ARTEX (trhhubsd/ARTEXX, starred 2,449 times) was modified to pull a backdoored Docker image (tomicdd/artex, 9,000 downloads) that grants an unauthenticated root shell via a hidden
verifyCaptcha()function triggered by a secret marker in the login's CAPTCHA field. As of November 4, 2026, 62 internet-facing ARTEX consoles (mostly in the US, Hong Kong, and China) were found running the backdoored build out of 1,645 total exposed ARTEX instances.Technical Details
Crafty Falcon exploits internet-facing apps, exposed APIs, and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, then invokes fund-transfer APIs from within victims' own allow-listed infrastructure, bypassing KYC, sanction, and transaction-limit controls. Initial access vectors include stolen long-lived API tokens, supply-chain compromise via forged commits, plaintext credentials in config files/source code, and services lacking MFA. Post-exploitation actions include reverse-engineering codebases for tailored exploits, abusing modified app packages for unauthorized API calls, executing micro-value test transactions before large fraudulent transfers, abusing merchant settlement APIs, and exploiting file-upload and deserialization chains leading to PHP/Node.js web shells. Operators delete logs and tamper with EDR to hinder detection. On the ARTEX backdoor, the hidden routine runs attacker input through
sh -cas root and returns output before any credential check, giving an unauthenticated root shell on every install; a nearly identical backdoored image exists under the congdonglinux/artex namespace.Remediation
CERT-In has published AI Security Auditing Guidelines requiring documented AI agent identities, least-privilege enforcement, human approval for consequential actions, and emergency interruption/credential revocation controls. Organizations running ARTEX or similar pentesting tools should verify image provenance, avoid running such tools as root on exposed ports, enforce MFA, rotate API tokens, and audit configuration files and repositories for forged commits or hardcoded credentials.