Docker Pulls Backdoored ARTEX Images; Existing Installs Remain at Risk
Trojanized Docker images of ARTEX, an AI-driven penetration testing console, hid a root shell in the login handler: commands sent through the login form's captcha field ran before the password was checked. Per BadByte, tomicdd/artex and congdonglinux/artex totaled 7,946 pulls before disclosure; Docker removed both on Nov 5, but on Nov 4, 46 of 62 exposed consoles still served the backdoored build and 637 GitHub repos still pointed compose files at them. CERT-In attributes the campaign to Crafty Falcon, which targets India's BFSI sector; rebuild from a trusted source and treat hosts that ran the images as compromised.
What happened
Docker images of ARTEX, an AI-driven penetration testing tool, shipped with a backdoor that granted a root shell without a password to anyone who knew the trick. The images drew 7,946 pulls before disclosure; Docker removed them on Nov 5, but copies already pulled or cached remain backdoored. CERT-In attributes the campaign to the actor Crafty Falcon and warns that India's BFSI sector is being targeted.
Why it matters
Any server that ran the compromised image should be treated as breached: commands sent through the login form's captcha field ran as root before the password was checked. Researchers found 62 internet-facing consoles running the backdoored build, and 637 GitHub repos still pointed compose files at the images. DailyDarkWeb reports ARTEX was abused in recent bank attacks.
What to do
Rebuild any ARTEX container from a trusted source; removal from Docker Hub does not clean existing installs. Isolate and investigate every host that ran the tomicdd/artex or congdonglinux/artex images. Fix repositories and compose files that still reference them.
For the technical team
- Affected
- ARTEX, ferramenta de IA para hacking; imagem Docker maliciosa com shell root escondido no manipulador de login · Docker images tomicdd/artex and congdonglinux/artex. On Nov 4, 46 of 62 exposed consoles still served the backdoored build; 637 GitHub repos pointed compose files at the images. No specific versions cited.
- Exploitation
- Backdoor reported by BadByte, granting a root shell without authentication. DailyDarkWeb reports ARTEX was abused in recent bank attacks. CERT-In describes actor Crafty Falcon's activity against India's BFSI sector as active and ongoing. 7,946 pulls before disclosure; analyst caveat: 62 exposed consoles are not proof of 62 intrusions.
- Fix
- Docker removed both images from Docker Hub on Nov 5; removal does not clean existing installs or copies cached on mirrors. Mitigation: rebuild from a trusted source and treat hosts that ran the images as compromised. No fixed version cited.
- Vector
- Backdoor in an ARTEX Docker image: root shell hidden in the login handler. Commands sent through the login form's captcha field ran before the password was checked, without authentication. Exploitable on any host running the image; 62 consoles found exposed to the internet.
- More details
- Vector: the login form's captcha field executed commands before the password check. CERT-In tracks the actor as Crafty Falcon, using publicly available AI-driven offensive security tools against India's BFSI sector. Discovery attributed to BadByte. Timeline: 7,946 pulls before disclosure; 46 of 62 consoles still served the compromised build on Nov 4; Docker removed the images on Nov 5.
Indicators (IoCs)
- tomicdd/artex
- congdonglinux/artex
Timeline
Malicious images were pulled from Docker Hub, but 46 of 62 exposed consoles still served the backdoored build on November 4.
CERT-In attributes the campaign to the actor Crafty Falcon and warns that India's financial sector is being targeted.
Incident opened.
Sources 3 sources
- @TheHackersNews @TheHackersNews
- CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access The Hacker News
- @DailyDarkWeb @DailyDarkWeb
