Backdoored ARTEX Docker image exposed 62 consoles to root access

The Hacker News reports that India’s Computer Emergency Response Team (CERT-In) has flagged an active AI-assisted threat campaign, tracked as Crafty Falcon, that is exploiting publicly available AI-driven offensive tools such as ARTEX, PentAGI, Cairn and CyberStrikeAI. CERT-In says the operation targets organisations across the Banking, Financial Services and Insurance (BFSI) sectors and has also hit cryptocurrency exchanges and digital asset service providers, with attackers aiming to steal keys and funds.

The agency notes that the threat actors use AI-enabled attack chains that run autonomously at machine speed, generate large volumes of tailored payloads, and adapt to target responses, while the supporting infrastructure rotates IP addresses within hours to days.

The alert follows CERT-In’s October 2026 warning about campaigns affecting non-banking financial companies, fintech entities and crypto-related firms, including credential theft from payment gateways and direct fund transfers from within whitelisted environments.

The article focuses on the “Copycat ARTEX” backdoor incident, in which a modified ARTEX docker image concealed a root-shell backdoor by altering docker-compose.yml to pull a tainted artex image (tomicdd/artex) from Docker Hub.

A hidden verifyCaptcha() function in the login handler enabled unauthenticated root access on first login, according to independent researcher Badbyte, who notes the backdoor was downloaded about 9,000 times and that 62 ARTEX consoles exposed on the internet were found between 2–4 November 2026, with 1,645 hosts in total serving the compromised console by 4 November.

CERT-In describes post-exploitation activity including reverse engineering for tailored exploits, unauthorized API calls with modified packages, fraudulent micro-transactions, log deletion and security-tool tampering, plus attempts to pivot to production environments using publicly accessible, non-production credentials and cloud credentials. The agency underscores the aim to move funds via mule accounts and to abuse merchant APIs, while warning that attackers continue to deploy and evolve AI-assisted capabilities.