Backdoored ARTEX copies grant root access to self-hosted consoles

The Indian Computer Emergency Response Team (CERT-In) has identified an active threat actor, tracked as Crafty Falcon, targeting the Banking, Financial Services, and Insurance (BFSI) sectors using artificial intelligence-assisted tools. Concurrently, security researchers have discovered that copycat versions of the open-source penetration testing tool ARTEX contain hidden backdoors that grant attackers full root access to any system running the compromised software.

What happened

CERT-In disclosed that Crafty Falcon is leveraging publicly available AI-driven offensive security tools such as ARTEX, PentAGI, Cairn, and CyberStrikeAI. These tools allow the threat actor to execute complete attack chains autonomously at machine speed, generating and refining tailored attack scripts in rapid succession. The infrastructure supporting these attacks rotates IP addresses frequently, making detection difficult. The campaign has specifically targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of cryptographic keys and funds.

In a separate but related development, the original developer of ARTEX removed the official repository from GitHub due to its misuse in real-world intrusions. However, multiple copies appeared on GitHub and Docker Hub to fill the void. Independent researcher Badbyte identified that one specific copy, hosted under the username trhhubsd, modified the docker-compose.yml file to pull a malicious image named tomicdd/artex from Docker Hub. This image has been downloaded approximately 9,000 times.

The malicious modification inserts a hidden function into the login handler. If a CAPTCHA field starts with a secret marker, the system executes the remaining input as a root shell command without checking credentials. This creates an unauthenticated root shell on every installation, bypassing standard code reviews. Between November 2 and November 4, 2026, researchers found 62 internet-facing ARTEX consoles serving this backdoored build, with the first instance appearing on October 20, 2026.

Key details

• CERT-In identifies Crafty Falcon as the threat actor using AI tools like ARTEX and PentAGI to target BFSI and crypto sectors.
• The backdoored ARTEX Docker image tomicdd/artex has been downloaded 9,000 times from Docker Hub.
• A hidden verifyCaptcha() function grants an unauthenticated root shell if the CAPTCHA field contains a secret marker.
• Researchers identified 62 backdoored ARTEX consoles online between November 2 and November 4, 2026.
• Twenty-six of the compromised consoles are located in the U.S., followed by 17 in Hong Kong and seven in China.
• A total of 1,645 hosts were found serving ARTEX consoles as of November 4, 2026, across various namespaces.

Background

ARTEX is an open-source penetration testing tool designed to help security professionals identify vulnerabilities in their own systems. When developers remove such tools from public repositories due to misuse, it often creates a vacuum that malicious actors fill with compromised copies. These copycat repositories may look identical to the original but contain subtle changes, such as altered Docker configuration files, that pull malicious container images instead of the legitimate software.

A root shell is the highest level of administrative access on a Linux or Unix-based system. Gaining root access allows an attacker to read, modify, or delete any file, install malware, and pivot to other systems on the network. In the context of self-hosted software, running a tool like ARTEX as root on an open port significantly increases the risk profile, especially if the software itself is compromised. The principle of least privilege suggests that services should run with only the permissions necessary to function, but many penetration testing tools require elevated privileges to operate effectively, creating a dangerous trade-off.

Why it matters

For teams that run their own software, this incident highlights the risks of relying on unofficial or unmaintained open-source tools. When a popular project is abandoned or removed, users often migrate to forks without verifying their integrity. In this case, the convenience of finding a working copy of ARTEX led thousands of users to download a image that secretly handed over control of their servers. This demonstrates how supply chain attacks can exploit the trust users place in familiar tool names and interfaces.

The use of AI-driven tools by threat actors also changes the speed and scale of attacks. Traditional manual penetration testing is slow and methodical, but AI-assisted tools can generate and test thousands of exploit variants in minutes. For self-hosting teams, this means that vulnerabilities must be patched faster than ever before. Additionally, the ability of these tools to adapt payloads based on target responses makes static defense mechanisms less effective, requiring more dynamic monitoring and response capabilities.

Furthermore, the compromise of ARTEX consoles exposes not just the host server but also the data collected by the tool. A compromised instance holds unpatched findings, live credentials, captured sessions, and network position information. An attacker who gains access to the backdoor can quietly change what the agents do on subsequent runs, turning a security tool into a persistent surveillance and attack platform within the organization's infrastructure.

What you can do

• Verify the source of all Docker images and open-source tools, avoiding unofficial forks unless you have audited the code yourself.
• Run security tools in isolated environments or containers with restricted privileges, never as root on production systems if avoidable.
• Monitor your network for unexpected outbound connections from security tools, which may indicate compromise.
• Implement multi-factor authentication (MFA) on all internet-facing applications and privileged endpoints to prevent credential theft.
• Regularly rotate API tokens and credentials, and avoid hard-coding them in configuration files or source code.
• Audit your scheduled jobs and background workers to ensure they are running as expected and have not been tampered with.