Trojanised ARTEX Docker Image Let Attackers Run Commands on Hosts

The ARTEX backdoor was baked into a trojanised Docker image of a Chinese-language AI penetration testing tool. The backdoored image, published under tomicdd/artex (and identical to congdonglinux/artex in digest), allowed an unauthenticated login to trigger arbitrary command execution on the host via the login flow. In practice, the attacker appended a new function, server[.]verifyCaptcha, which runs a shell command received in the login payload and returns its output before credentials are checked.

The evidence includes a 160‑byte function added to the binary and a login handler that gained a new Captcha field. The backdoored build is identified by a UI build ID 3aC1db3gGU08O4UHbAt4J, and the compromised binary hash is d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573. The commit history shows the change to direct installations via Docker, with the backdoor not removed by updates.

The reach of the incident is substantial: by 4 November, 46 of 62 ARTEX consoles exposed on the internet were serving the backdoored build, with 1,645 live consoles total running ARTEX, and 7,946 pulls of the backdoored image by 3 November. Investigations trace the incident to a replacement image after the original ARTEX author paused updates and moved to a closed-source workflow, with an unauthorised copy of the source later uploaded under trhhubsd/ARTEXX and then renamed.

The backdoor’s operator could access plaintext secrets stored by ARTEX, including the database password, LLM API keys, and credentials harvested from targets, while the compromised consoles maintained discovery and command execution capabilities across engagements. Affected parties include concrete banks and organisations targeted in late September to early October, and public discussion and fingerprinting indicators have enabled subsequent detection efforts. Researchers from CrowdStrike, BleepingComputer and The Register are cited in relation to the campaign and exposure.