As many as 62 ARTEX consoles on the internet were found serving a backdoored build between November 2 and 4, 2026, with the first compromised instance appearing on October 20, 2026 — a discovery that ties open-source offensive tooling directly to active, AI-assisted intrusions against financial services and cryptocurrency providers.
CERT-In links Crafty Falcon and AI-driven attack chains to BFSI and crypto theft
The Indian Computer Emergency Response Team (CERT-In) reported that an AI-assisted threat actor it tracks as Crafty Falcon is conducting "active and ongoing" operations against organizations in the Banking, Financial Services, and Insurance (BFSI) sector. CERT-In said the activity also targeted cryptocurrency exchanges and digital asset service providers, "resulting in the theft of keys and funds."
CERT-In named publicly available AI-driven offensive security tools involved in the campaigns: ARTEX, PentAGI, Cairn, and CyberStrikeAI. "These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession, and adapt their payloads based on target responses," the agency stated, adding that the supporting infrastructure "rotates IP addresses within hours to days."
Initial access and lateral movement: specific vectors CERT-In observed
The advisory catalogs concrete entry points exploited by the adversary, including:
- Use of stolen long-lived static, hard-coded API tokens
- Supply chain compromise of source code repositories via forged commits
- Exploitation of plaintext credentials in configuration files, source code, or databases
- Access to applications and remote services lacking multi-factor authentication (MFA)
CERT-In warned that this pattern defeats application-level controls such as loan creation, KYC, sanction and beneficiary verification, balance sufficiency checks, and per-transaction limits. The agency also documented post-exploitation activity designed to obscure detection and amplify theft: deleting logs, tampering with endpoint security tools, reverse-engineering codebases, and initiating unauthorized API calls using modified application packages.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageARTEX supply: backdoored Docker images, hidden root shell, and distribution
The open-source ARTEX penetration-testing tool became a vector when its GitHub repository was taken down by the developer and multiple copies appeared on GitHub and Docker Hub. An independent researcher known as Badbyte examined a copy that changed a single line in docker-compose.yml to pull the tomicdd/artex image from Docker Hub and concealed a new routine that grants a root shell via an unauthenticated request.
Badbyte described the modification: "It adds a hidden verifyCaptcha() function to the login handler: if the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned, before any credential check." In Badbyte's words, that yields "an unauthenticated root shell on every install, and it never shows up in a code review."
Docker Hub statistics cited in the reporting show the tomicdd/artex image has been downloaded 9,000 times. Security scans found 1,645 hosts serving the ARTEX console as of November 4, 2026; of the 62 consoles confirmed serving the backdoored build between November 2–4, 2026, 26 are in the U.S., 17 in Hong Kong and seven in China. The reporting lists multiple Docker Hub namespaces that published images named "artex," including congdonglinux/artex (also backdoored and identical to tomicdd/artex), mianhuatang11/artex, autumn26/artex and others.
CERT-In's AI Security Auditing Guidelines: governance and control requirements
In parallel to its alert, CERT-In published the Artificial Intelligence Security Auditing Guidelines. The framework prescribes auditable requirements intended to ensure "governance, security, privacy, fairness, transparency, resilience and auditability of AI systems." Specifics include testing an AI agent's documented identities, authorized objectives, approved tool use, permission boundaries, and adherence to the principle of least privilege.
The guidelines require human approval for consequential actions by AI agents and expect high-risk AI systems to include emergency interruption, credential revocation, and controls preventing automatic restarts. CERT-In said effective assurance "requires organisational accountability, technical testing, data and model governance, continuous monitoring, human oversight, incident response and third-party assurance," and that its framework provides requirements "proportionate to the nature, scale, autonomy and potential impact of each AI system."
What this means for technologists, regulators, and affected financial operators
- Technologists and security teams: expect attackers to use AI to rapidly generate, test, and iterate exploit scripts and payloads; the CERT-In advisory stresses monitoring for lateral API abuse, tampering with logs and security tooling, and activity that uses micro-value test transactions (such as Rs. 1) to validate unauthorized fund flows.
- Policymakers and regulators: CERT-In's auditing guidelines frame a set of technical and governance controls — human approval for consequential actions, emergency interruption, credential revocation — that may inform compliance expectations for AI systems used in security-sensitive contexts.
- Affected enterprises (BFSI, NBFCs, fintechs, payment service providers, cryptocurrency operators): the agency highlights specific exposure points — long-lived tokens, exposed APIs, non-production environments with shared credentials — and documents real-world misuse, including theft of API credentials and invocation of fund-transfer APIs from within allow-listed infrastructure.
The record in this episode is stark: adversaries are combining AI-driven tooling with contaminated supply channels to convert curiosity and convenience into privileged access. CERT-In's mapping of techniques and its AI auditing guidance offer a pragmatic checklist — but the persistence of backdoored images and the discovery of unauthenticated root shells on widely downloaded containers underline a basic truth voiced by the investigator Badbyte: "The people they were after had already chosen to run an unvetted attack tool as root on an open port."
