Skip to navigation

Threat reportSupply ChainTL-2026-5466

Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon

criticalACTIVE

Trojanized Docker Hub images of the open-source AI pentest framework ARTEX contain a hidden verifyCaptcha() function in the login handler that runs attacker-supplied commands as root, before any credential check, when the CAPTCHA field starts with a secret marker. 62 backdoored consoles were identified online on Nov 2-4, 2026 (26 in the U.S., 17 in Hong Kong, 7 in China), and CERT-In separately warns of the AI-assisted actor Crafty Falcon using ARTEX against Indian BFSI and crypto entities.

Key facts for ARTEX Docker backdoor

IdentifiersTL-2026-5466
Also known asARTEX Docker image backdoor, ARTEX verifyCaptcha backdoor
SeverityCRITICAL
First disclosed
Exploitation statusExploited in the wild
Affected productsAutumn-27 (ARTEX project) ARTEX AI penetration-testing framework (Docker images)
Weaknesses (CWE)CWE-506, CWE-798, CWE-306
ToolsARTEX, Cairn, CyberStrikeAI, PentAGI
MITRE ATT&CK techniquesT1059.004 Command and Scripting Interpreter: Unix Shell, T1078 Valid Accounts, T1190 Exploit Public-Facing Application, T1195.002 Compromise Software Supply Chain, T1204.003 User Execution: Malicious Image, T1528 Steal Application Access Token, T1552.001 Unsecured Credentials: Credentials In Files, T1588.007 Obtain Capabilities: Artificial Intelligence, T1657 Financial Theft, T1685 Disable or Modify Tools
MotivationUNKNOWN
Target sectorsfinance, banking, insurance, cryptocurrency, fintech, security-research
Target regionsindia, North America, hong kong, china
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for ARTEX Docker backdoor

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5466 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX Backdoor verifyCaptcha RCE - Root Shell Spawned by /app/artex

TL-2026-5466: the trojanized ARTEX image (tomicdd/artex and clones) hides a verifyCaptcha() function in the /api/auth/login handler that passes attacker input to sh -c as root before any credential check. This search finds a POSIX shell started with -c whose parent is the /app/artex binary, the process-level footprint of the backdoor trigger (T1190, T1059.004).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059.004
  • Data sources: sysmon_for_linux, linux_process_creation, microsoft_defender_for_endpoint
  • Severity: critical
  • Confidence: medium

Splunk SPL

index=linux sourcetype=sysmon:linux EventCode=1 earliest=-24h ParentImage="*/app/artex" Image IN ("*/sh","*/bash","*/dash","*/ash") CommandLine="* -c *" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host ParentImage | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFolderPath endswith "/app/artex"
| where FileName in~ ("sh", "bash", "dash", "ash")
| where ProcessCommandLine contains " -c "
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessSHA256
| order by Timestamp desc

Sigma

title: ARTEX Backdoor Process Spawning Shell With -c (verifyCaptcha RCE)
id: 7b1d2f4e-3c6a-4e58-9a0f-1c2d3e4f5a61
status: experimental
description: Detects a POSIX shell started with -c whose parent is the /app/artex binary, the process footprint of the verifyCaptcha backdoor in trojanized ARTEX Docker images (tomicdd/artex and clones).
references:
  - https://badbyte.io/artex-backdoor-docker-image/
  - https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/app/artex'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/ash'
    CommandLine|contains: ' -c '
  condition: selection
falsepositives:
  - Legitimate ARTEX deployments (official builds) that run tooling through a shell
level: high

Known false positives:

  • Official or self-built ARTEX deployments legitimately run pentest tooling through sh -c from /app/artex
  • Authorized red-team engagements using ARTEX inside containers

Tuning notes: Index and sourcetype assume Sysmon for Linux (sysmon:linux). On a host known to run a clean ARTEX build, baseline normal child commands and exclude them; otherwise treat every hit as suspect until the image digest and /app/artex SHA256 (d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573) are verified. Prioritize hits with commands such as id, whoami, cat /etc/passwd or curl/wget.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Backdoored ARTEX Docker Image Pulled or Binary Executed · unlock with TL Creds
  • Credential and API Key Harvesting on ARTEX Hosts · unlock with TL Creds
  • Internet-Exposed ARTEX Console on Port 8787 and Backdoored-Host Range Contact · unlock with TL Creds
  • ARTEX Backdoor Trigger - POST to [indicator] on Port 8787 · unlock with TL Creds
  • AI Offensive Tool Execution (ARTEX, PentAGI, Cairn, CyberStrikeAI) · unlock with TL Creds
  • DNS Query for [indicator] LLM Gateway Used by ARTEX Operators · unlock with TL Creds
  • Log Deletion and Security Tool Tampering on ARTEX Hosts · unlock with TL Creds
  • Traffic to ARTEX Operator Infrastructure and Backdoored Console Range · unlock with TL Creds

Indicators of compromise for ARTEX Docker backdoor

As of 2026-11-07, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5466.

Sample indicators (3 of 24)

  • IP address: 23.248.226[.]250
  • Domain: xcai[.]pro
  • File hash: d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

24 indicators of compromise · unlock with TL Creds. Compare plans

How ARTEX Docker backdoor works

ARTEX is an open-source, multi-agent AI-assisted penetration-testing framework with a planner-and-worker architecture. On 8 October 2026 its original author (GitHub: Autumn-27) took the project private. According to researcher Badbyte (badbyte.io), within hours a new Docker Hub account (tomicdd) was created (18:50 UTC) and a backdoored image pushed (19:41 UTC). A GitHub account (trhhubsd) then published a modified copy of the source (trhhubsd/ARTEX, reported at 2,449 stars and 600+ forks) containing a one-line change in docker-compose.yml (line 18, commit a4f4d38) that redirects the image from autumn27/artex to tomicdd/artex. The original repository was removed from GitHub, and a fork (imxv/ARTEXX) took over the fork network; 637 repositories were reported to still reference the malicious image.

The trojanized binary (/app/artex, layer 15 of the image) was built from upstream commit 5c0dbd4 plus uncommitted changes. Compared with official v0.3.15 it adds a 160-byte server.verifyCaptcha function, grows server.(*Server).authLogin by 512 bytes, and adds a fourth Captcha field to the login request struct. A single unauthenticated POST to /api/auth/login with a secret marker at the start of the captcha field causes the remainder to be executed through sh -c as root and the output to be returned in the response, before credentials are checked. The marker is withheld by the researcher. The compose file exposes port 8787 to the internet by default.

A compromised console gives the attacker the operator's API keys (Anthropic, OpenAI, Brave, Tavily), database and harvested target credentials, MITM proxy traffic including the CA private key, the JWT signing key (allowing forged 7-day admin tokens), and engagement targets and findings. The compromise therefore also exposes the data of ARTEX operators' victims. Badbyte counted 1,645 ARTEX consoles online on 4 November, of which 62 were identified as backdoored (46 still serving the backdoored build) and 590+ ran unversioned builds indistinguishable from rebuilt trojans. Backdoored consoles clustered at ColoCrossing (15 hosts in 104.168.63.0/24 sharing an SSH key) and a Hong Kong VPS network (7 hosts). First backdoored instance was seen on 20 October 2026. tomicdd/artex (about 9,000 pulls) and congdonglinux/artex were removed on 5 November.

Separately, CERT-In advisory CIAD-2026-0058 describes Crafty Falcon, an AI-assisted financial threat actor targeting BFSI, cryptocurrency exchanges and digital asset service providers with public AI offensive tools (ARTEX, PentAGI, Cairn, CyberStrikeAI). Reported access and post-exploitation behavior includes stolen hard-coded long-lived API tokens, forged-commit supply chain compromise, plaintext credentials in config files or source code, applications lacking MFA, reverse engineering of application code, unauthorized API calls through modified packages, Rs 1 micro-value test transactions before large transfers, log deletion, endpoint security tool tampering, cloud infrastructure command execution, abuse of payment aggregator settlement APIs, and exploitation of file-upload and deserialization flaws in PHP/Node.js applications. The sources do not establish that Crafty Falcon operates the backdoored images; the link is that ARTEX is among its tooling. Related public reporting (Zscaler ThreatLabz, CrowdStrike via BleepingComputer) documents other ARTEX operators, including a China-nexus actor tracked as Vapor Panda.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.003 User Execution: Malicious Image

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Credential Access

T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1588.007 Obtain Capabilities: Artificial Intelligence

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation for ARTEX Docker backdoor

Immediate actions

  • Stop and remove any container pulled from tomicdd/artex, congdonglinux/artex, mianhuatang11/artex, autumn26/artex, andy1099zz/artex, dgddw/artex, ylh440104/artex or trhhubsd/ARTEX
  • Check the /app/artex binary for SHA256 d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573 and the UI build ID 3aC1db3gGU08O4UHbAt4J
  • Remove ARTEX consoles (default port 8787) from direct internet exposure
  • Rotate all secrets stored in or reachable from any ARTEX instance: LLM provider API keys, database credentials, JWT signing key, MITM proxy CA key, harvested target credentials
  • Search web and proxy logs for unauthenticated POST /api/auth/login requests that return command output such as uid=0(root)

Workarounds

  • Rebuild ARTEX from audited source rather than a prebuilt image
  • Restrict access to the console to a management network or VPN

Longer-term hardening

  • Enforce container image scanning and verify publisher provenance before pulling images
  • Pin images by digest and avoid docker-compose files from forks or unverified repositories
  • Enable MFA on all applications and remove hard-coded or long-lived API tokens and plaintext credentials from config files and source code
  • Monitor payment and disbursement API usage for micro-value test transactions and anomalous settlement API calls
  • Alert on log deletion and endpoint security tool tampering

Affected and fixed versions

  • Autumn-27 (ARTEX project) — ARTEX AI penetration-testing framework (Docker images)
    Vulnerable versions: Docker Hub images tomicdd/artex, congdonglinux/artex, mianhuatang11/artex, autumn26/artex, andy1099zz/artex, dgddw/artex, ylh440104/artex, trhhubsd/ARTEX; docker-compose.yml referencing tomicdd/artex
    Fixed in: Official upstream v0.3.15 compared by the researcher as the clean baseline; no vendor fix issued

Timeline of ARTEX Docker backdoor

  • End of the Aug 4 - Oct 4, 2026 activity window of a separate ARTEX-assisted campaign documented by Zscaler ThreatLabz (CrowdStrike disclosed related activity on Oct 7)
  • Backdoored image locked-ioc-13 pushed at 19:41 UTC; GitHub account trhhubsd uploads modified source whose docker-compose.yml points to locked-ioc-13 (commit a4f4d38)
  • locked-ioc-23 author (Autumn-27) takes the project private; the locked-ioc-21 Docker Hub account is created at 18:50 UTC
  • First backdoored locked-ioc-23 console observed online
  • Detection window begins in which 62 backdoored consoles are identified online (26 US, 17 Hong Kong, 7 China)
  • Badbyte scan finds 1,645 locked-ioc-23 consoles online, 46 still serving the backdoored build and 590+ with unversioned builds
  • The Hacker News reports the backdoor and CERT-In advisory CIAD-2026-0058 on locked-ioc-18
  • locked-ioc-13 (about 9,131 pulls) and locked-ioc-3 removed from Docker Hub

Sources cited for ARTEX Docker backdoor

Further reading

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats