EN PT-BR
← Voltar ao feed
critical banking financial_services insurance cryptocurrency financial services fintech

CERT-In warns of AI-assisted Crafty Falcon attacks on Indian fintechs and BFSI; backdoored ARTEX Docker images found separately

3 fonte(s) · 3 atualização(ões) · publicado 05/11/2026 05:42 · coletado há 2 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 06/11/2026 00:02; os links antigos trazem para cá.

Fontes: theregister.com ↗ infosecurity-magazine.com ↗ thehackernews.com ↗

CERT-In issued an updated advisory on November 4, 2026, warning of a "significant escalation" (theregister.com) in attacks by a newly named AI-assisted financial threat actor, Crafty Falcon. It targets Indian BFSI and non-banking financial firms, including digital lending platforms, fintechs, payment aggregators and service providers, wallet operators, cryptocurrency exchanges and digital asset providers (thehackernews.com, infosecurity-magazine.com, theregister.com). The campaign was first detected in October. An earlier restricted-distribution advisory did not stop repeat attacks, because previously compromised entities were deliberately re-targeted after incomplete remediation, often on weekends, holidays and other low-monitoring windows (infosecurity-magazine.com, theregister.com). The actor uses AI-driven offensive tools, namely ARTEX, Cairn, CyberStrikeAI and, per one source, PentAGI, to automate attack chains and generate script variants. CERT-In assesses the activity as active and escalating but has not formally attributed it, although patterns are consistent with China-based actors (infosecurity-magazine.com). Separately, researcher Badbyte found that a popular GitHub fork of ARTEX pulls a backdoored Docker image. As of November 4, 62 of 1,645 exposed ARTEX consoles were running it (thehackernews.com). The sources do not state that Crafty Falcon is using this backdoored image.

Entenda a falha

A vulnerabilidade

No CVE was assigned. This is a supply-chain backdoor, not a coding bug, in copies of the open-source AI pentesting tool ARTEX. The GitHub fork trhhubsd/ARTEXX (2,449 stars, over 600 forks) changed one line in docker-compose.yml to pull the Docker image tomicdd/artex (about 9,000 downloads). A near-identical image, congdonglinux/artex, is also backdoored. An attacker only needs network reach to the console's login endpoint, with no credentials or user interaction, and gets an unauthenticated root shell. On November 4, 62 of 1,645 exposed ARTEX consoles served the backdoored build, mostly in the US, Hong Kong and China. No fixed version exists; the advice is to verify image provenance. The sources do not tie these images to Crafty Falcon intrusions.

Como funciona

A user deploys ARTEX from the modified compose file, which pulls the trojanized image from Docker Hub. The console listens on an exposed port and receives login requests. A hidden verifyCaptcha() function in the login handler inspects the CAPTCHA field. If the field starts with a secret marker, the rest of the value is run through sh -c as root and the output is returned in the response. This happens before any credential check, so the normal login logic never runs for that request.

Por que é vulnerável

The cause is deliberately planted malicious code, not an accident. The fork changed the deployment file to point to an attacker-controlled image, and that image adds a pre-authentication command-execution path that runs as root. According to the researcher, the backdoor never shows up in a code review. Users who ran an unvetted attack tool as root on an open port made the impact worse. The original developer had taken the repository down after it was abused in real intrusions, and copies filled the gap.

Onde está

The hidden verifyCaptcha() function in the login handler of the tomicdd/artex image, and the single changed line in docker-compose.yml of the trhhubsd/ARTEXX fork.

Como foi descoberta

The independent researcher Badbyte found the backdoor and shared the details with The Hacker News by email. The first backdoored console was online by October 20, 2026, twelve days after the image was pushed to Docker Hub. Badbyte counted 62 backdoored consoles between November 2 and 4. The trhhubsd and mhtsec repositories are no longer available for download. CERT-In's separate Crafty Falcon advisory only lists ARTEX among the tools the actor uses and does not mention the backdoor.

Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 00:17.

Detalhes técnicos

  • Initial access: The actor hunts for internet-exposed non-production environments (UAT, staging, testing, development) and harvests shared credentials, tokens and network paths to pivot into production (infosecurity-magazine.com, theregister.com). Other vectors are stolen long-lived API tokens, supply-chain compromise via forged commits, plaintext credentials in config files or source code, and services without MFA (thehackernews.com).
  • Exploitation and tooling: The actor reverse-engineers application codebases to craft tailored exploits and uses modified application packages to make unauthorized API calls that bypass client-trust assumptions. It quickly weaponizes newly disclosed file-upload and deserialization flaws to deploy PHP and Node.js web shells, and it produces many functionally identical application variants in rapid succession, consistent with AI-generated code (infosecurity-magazine.com, theregister.com, thehackernews.com).
  • Evasion: The actor evades IP allow-listing by routing traffic through trusted third-party fetcher pools such as content-acceleration services and app-store review fetchers. It abuses AWS Systems Manager and Lambda to run commands and deploy files, and it deletes logs and tampers with EDR (infosecurity-magazine.com, thehackernews.com). It can rotate infrastructure IPs within hours (thehackernews.com).
  • Fraud: The actor steals payment aggregator, gateway and partner-bank API credentials and invokes fund-transfer APIs from inside victims' allow-listed infrastructure, bypassing KYC, sanction and transaction-limit controls (thehackernews.com). It sends micro-value test transactions before large transfers and abuses merchant settlement APIs. Against crypto exchanges and VDASPs it steals wallet keys to drain funds (infosecurity-magazine.com, theregister.com).
  • ARTEX backdoor (Badbyte): The GitHub fork trhhubsd/ARTEXX (2,449 stars) was modified to pull the Docker image tomicdd/artex (9,000 downloads). A hidden verifyCaptcha() function, triggered by a secret marker in the CAPTCHA field, passes attacker input through sh -c as root and returns the output before any credential check. This gives an unauthenticated root shell on every install. A nearly identical image exists under the congdonglinux/artex namespace. The 62 backdoored consoles are mostly in the US, Hong Kong and China (thehackernews.com).

Remediação

  • Monitoring and logging: Maintain 24x7 monitoring with lowered alert thresholds in low-activity periods. Centralize cloud audit-log monitoring, improve event logging and real-time anomaly alerting, and tune the SIEM for machine-speed multi-technique attacks (infosecurity-magazine.com, theregister.com).
  • Environments and cloud: Keep test and development environments off the public internet and strictly separate them from production. Restrict cloud and serverless execution to approved principals. Use read-only deployment directories with file-integrity monitoring (infosecurity-magazine.com, theregister.com).
  • Transactions and keys: Apply server-side transaction validation with request signing and certificate pinning. Enhance monitoring for micro-value test transfers, and protect crypto wallet keys with HSMs (infosecurity-magazine.com).
  • Patching and architecture: Set rapid patching SLAs with WAF virtual patching for file-upload and deserialization flaws, and adopt zero-trust and micro-segmentation (infosecurity-magazine.com).
  • AI governance: Prohibit unauthorized AI offensive tools and govern LLM API usage. CERT-In published AI Security Auditing Guidelines requiring documented AI agent identities, least privilege, human approval for consequential actions, and emergency interruption and credential revocation (infosecurity-magazine.com, thehackernews.com).
  • Credential hygiene: Enforce MFA, rotate API tokens, and audit configs and repositories for forged commits or hardcoded credentials (thehackernews.com).
  • ARTEX users: Verify Docker image provenance, avoid running such tools as root on exposed ports, and check for the tomicdd/artex and congdonglinux/artex images (thehackernews.com).
  • Reporting: Report incidents to [email protected] and India's Cybercrime Coordination Centre (I4C) (infosecurity-magazine.com).

Relatos divergentes

  • Attribution: infosecurity-magazine.com says activity patterns are consistent with those previously linked to China-based actors, and that CERT-In stopped short of formal attribution. theregister.com says only that the tools are associated with Chinese-speaking users. No source names a state sponsor.
  • Tool list: thehackernews.com lists four tools, ARTEX, PentAGI, Cairn and CyberStrikeAI. theregister.com lists three, without PentAGI. infosecurity-magazine.com says ARTEX is based on a multi-agent LLM framework that it spells "PetAGI", which is likely the same project as PentAGI. This is unconfirmed.
  • Victim scope: thehackernews.com frames targets as BFSI plus crypto. infosecurity-magazine.com emphasizes non-banking financial companies. theregister.com stresses fintechs, payment providers and wallet operators. These are broadly overlapping rather than contradictory.
  • Test-payment amount: infosecurity-magazine.com cites Rs. 1 test transactions. theregister.com cites roughly $0.01. Both describe the same micro-payment validation technique.
  • Link to the backdoored ARTEX images: Only thehackernews.com reports them, as a separate researcher finding. It does not tie them to Crafty Falcon intrusions.

Linha do tempo

  1. theregister.com ↗ · pub. 05/11/2026 22:17 · coletado 05/11 23:00

    CERT-IN Warns 'CRAFTY FALCON' AI-Assisted Actor Escalates Attacks on Indian Fintechs

    ler a análise desta fonte

    India's CERT-IN has issued an updated advisory warning of a "significant escalation" in attacks by an AI-assisted financial threat actor it has named CRAFTY FALCON, targeting digital lending platforms, fintechs, payment service providers and wallet operators. First detected in October, the campaign has continued despite remediation efforts, with CERT-IN noting that previously compromised entities are being deliberately re-targeted, often after incomplete fixes, with attacks timed to weekends, holidays and other low-monitoring windows to delay detection. The actor is linked to AI-enhanced offensive tooling — the ARTEX pen-testing tool, the Cairn attack search engine, and the CyberStrikeAI framework — all associated with Chinese-speaking users. CERT-IN assesses the attacks as active and escalating, warranting 24x7 monitoring by targeted sectors.

    Technical Details

    CRAFTY FALCON hunts for internet-exposed test or development environments to harvest artefacts such as shared credentials, tokens, and network paths that enable lateral movement into production systems. Once inside, the group rewrites victim applications to issue unauthorized API calls, abusing the trust defenses place in legitimate internal apps so the malicious calls go unflagged. CERT-IN notes the group produces many functionally identical application variants in rapid succession, a pattern consistent with AI-generated and iteratively refined code, and the actor also moves quickly to weaponize newly disclosed vulnerabilities. To validate successful compromise, the crew first sends micro-payments of roughly $0.01 through payment APIs before escalating to larger fraudulent transfers; against cryptocurrency exchanges and virtual digital asset service providers, it instead steals wallet keys to drain funds.

    Remediation

    CERT-IN recommends improving event logging, real-time anomaly monitoring, and alerting; keeping test and development environments off the public internet; restricting access to cloud resources (which the actor favors for running attacks); and maintaining continuous 24x7 monitoring given the active and escalating nature of the campaign.

  2. infosecurity-magazine.com ↗ · pub. 05/11/2026 11:25 · coletado 05/11 12:01

    CERT-In Warns of 'Crafty Falcon' AI-Driven Attacks on Indian Financial Sector

    ler a análise desta fonte

    India's CERT-In issued an advisory on November 4 warning that non-banking financial companies—including digital lending platforms, fintech firms, payment aggregators and cryptocurrency exchanges—are being repeatedly targeted by a newly identified threat actor dubbed Crafty Falcon. Despite an earlier restricted-distribution advisory in October, affected organizations suffered repeat attacks due to incomplete remediation. Crafty Falcon uses AI and agentic AI penetration-testing tools to automate reconnaissance, exploit development and payload adaptation, with activity patterns consistent with those previously linked to China-based actors, though CERT-In stopped short of formal attribution.

    Technical Details

    Crafty Falcon gains initial access through internet-exposed non-production environments (UAT, staging, testing) and pivots to production systems via shared credentials, tokens or network paths. The actor reverse-engineers application codebases to craft tailored exploits, uses modified application packages to bypass client-trust assumptions in APIs, and evades IP allow-listing by routing traffic through trusted third-party fetcher pools (content-acceleration services, app-store review fetchers). It abuses cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files while blending into legitimate operations. Before large-value fraud, the actor performs micro-value test transactions (e.g., Rs. 1) and abuses merchant settlement APIs of payment aggregators; cryptocurrency exchanges are targeted for wallet-key theft. The group rapidly exploits newly disclosed file-upload and deserialization vulnerabilities to deploy PHP and Node.js web shells. Observed offensive AI tooling includes ARTEX (based on the PetAGI multi-agent LLM framework), CyberStrikeAI, and the attack search engine Cairn, enabling autonomous, machine-speed attack-chain execution and rapid script variant generation.

    Remediation

    CERT-In recommends 24/7 monitoring with lowered alert thresholds during low-activity periods, centralized cloud audit-log monitoring, restricting cloud/serverless execution to approved principals, strict separation of non-production and production environments, read-only deployment directories with file-integrity monitoring, server-side transaction validation with request signing and certificate pinning, rapid patching SLAs with WAF virtual patching for file-upload/deserialization flaws, enhanced transaction monitoring for micro-value test transfers, hardware security modules for crypto wallet keys, prohibition of unauthorized AI offensive tools, LLM API usage governance, SIEM tuning for machine-speed multi-technique attacks, and adoption of zero-trust and micro-segmentation principles. Organizations are urged to report incidents to [email protected] and India's Cybercrime Coordination Centre (I4C).

  3. thehackernews.com ↗ · pub. 05/11/2026 05:42 · coletado 05/11 08:00 primeiro registro

    CERT-In Warns of AI-Driven "Crafty Falcon" Attacks on Indian BFSI as Backdoored ARTEX Docker Images Expose Root Access on 62 Consoles

    ler a análise desta fonte

    CERT-In has disclosed an active campaign by an AI-assisted threat actor tracked as Crafty Falcon, targeting Banking, Financial Services, and Insurance (BFSI) organizations, cryptocurrency exchanges, and digital asset providers in India. The actor leverages publicly available AI-driven offensive security tools — ARTEX, PentAGI, Cairn, and CyberStrikeAI — to autonomously execute full attack chains, generate tailored scripts, and rotate infrastructure IPs within hours. Separately, researcher Badbyte found that a popular GitHub fork of ARTEX (trhhubsd/ARTEXX, starred 2,449 times) was modified to pull a backdoored Docker image (tomicdd/artex, 9,000 downloads) that grants an unauthenticated root shell via a hidden verifyCaptcha() function triggered by a secret marker in the login's CAPTCHA field. As of November 4, 2026, 62 internet-facing ARTEX consoles (mostly in the US, Hong Kong, and China) were found running the backdoored build out of 1,645 total exposed ARTEX instances.

    Technical Details

    Crafty Falcon exploits internet-facing apps, exposed APIs, and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, then invokes fund-transfer APIs from within victims' own allow-listed infrastructure, bypassing KYC, sanction, and transaction-limit controls. Initial access vectors include stolen long-lived API tokens, supply-chain compromise via forged commits, plaintext credentials in config files/source code, and services lacking MFA. Post-exploitation actions include reverse-engineering codebases for tailored exploits, abusing modified app packages for unauthorized API calls, executing micro-value test transactions before large fraudulent transfers, abusing merchant settlement APIs, and exploiting file-upload and deserialization chains leading to PHP/Node.js web shells. Operators delete logs and tamper with EDR to hinder detection. On the ARTEX backdoor, the hidden routine runs attacker input through sh -c as root and returns output before any credential check, giving an unauthenticated root shell on every install; a nearly identical backdoored image exists under the congdonglinux/artex namespace.

    Remediation

    CERT-In has published AI Security Auditing Guidelines requiring documented AI agent identities, least-privilege enforcement, human approval for consequential actions, and emergency interruption/credential revocation controls. Organizations running ARTEX or similar pentesting tools should verify image provenance, avoid running such tools as root on exposed ports, enforce MFA, rotate API tokens, and audit configuration files and repositories for forged commits or hardcoded credentials.