Backdoored ARTEX: root on 62 consoles

A copied build of ARTEX, the AI penetration-testing framework, has been serving a hidden root path on consoles left open to the internet. Researcher Badbyte told The Hacker News that 62 of those consoles ran the backdoored build between November 2 and November 4, 2026. The first was online by October 20, twelve days after the container image was published. Docker Hub’s count for that image is about 9,000 downloads. A separate census the same week found 1,645 hosts offering an ARTEX console at all.

The same week, India’s Computer Emergency Response Team said an AI-assisted actor it calls Crafty Falcon is in an active campaign against banks, lenders, insurers, and other financial firms in the country. CERT-In names public offensive frameworks, ARTEX among them, plus PentAGI, Cairn, and CyberStrikeAI. The agency says the crew has also hit cryptocurrency exchanges and digital-asset firms and taken keys and funds.

What CERT-In says is already in motion

CERT-In calls the activity ongoing, and faster than a person stepping through a playbook one host at a time. The October warning this update follows already covered non-bank lenders, digital lending apps, fintech companies, payment firms, and crypto wallet operators. The path in the advisory runs from internet-facing apps and exposed interfaces to payment-aggregator, gateway, and partner-bank credentials, then to transfer calls placed from inside the victim’s own allow-listed network. Checks that live in the loan form, the identity review, the beneficiary check, and the per-transfer cap never see a call that skipped them. Funds move to mule accounts at other banks. Logs disappear. Endpoint tools get altered.

The same advisory lists long-lived API tokens left in code, commits the team did not make, plaintext secrets in config and databases, and remote access with no second factor. Public non-production systems have been the step into production. Cloud accounts have been used to run the operator’s commands. CERT-In also published auditing rules for AI systems, including a requirement that an agent get a person’s approval before a consequential action, and that a high-risk agent can be stopped, have its credentials pulled, and be kept from starting itself again. Those rules are the control list. Crafty Falcon is the campaign already using the gap.

The console that was a different image

ARTEX’s developer removed the original repository after the framework showed up in real intrusions. Copies took its place. Badbyte followed one of them, a repository starred 2,449 times and forked more than 600 times before it disappeared, to a single swap: the stack pulled a different container image. That image, published as tomicdd/artex, carries a routine that yields root from an unauthenticated request to the login page. A review of the repository the operator believes they installed does not show it. The same implant is in congdonglinux/artex. Other Docker Hub namespaces are publishing images under the ARTEX name as well. An unofficial pull is a different codebase from the project the developer removed.

Of the 62 backdoored consoles, 26 were in the United States, 17 in Hong Kong, and seven in China. A console in that set holds whatever it was pointed at: unpatched findings, live credentials, captured sessions, and a foothold on the network under test. Whoever published the image can also change what the agents do on the next run. People who installed a copy out of curiosity still ended up with root available to someone else. People who installed it to attack a target handed that engagement to a third party.

What to do this week

If any host pulled tomicdd/artex, congdonglinux/artex, or another ARTEX image you cannot tie to a source your security team has approved, take the console off the network and treat the machine as compromised. Replace the image only from a source that approval already covers. Rotate every credential the console stored or could read, including secrets gathered in an authorized test, API keys, and session tokens. Assume the findings and the target list left with them. A lab box that was only curious still offered root to someone else.

Banks, non-bank lenders, payment firms, and crypto operators in India should treat Crafty Falcon as current. Retire long-lived static API tokens. Require a second factor on remote access and on partner portals. Give a public test environment its own credentials, separate from production. Watch for a token-sized transfer that only proves a path, then a large one, and for transfer calls that leave your allow-listed addresses with no matching customer action. Keep payment logs and endpoint telemetry on a system the host under attack cannot wipe.

An ARTEX install the security team did not authorize in writing is an incident, backdoored image or clean fork. The backdoor is the new fact. The campaign against the financial sector is why the install matters.

This briefing relies on public reporting by The Hacker News, on CERT-In’s advisory, and on researcher Badbyte’s account. It does not include exploit procedures.