# Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon

> Trojanized Docker Hub images of the open-source AI pentest framework ARTEX contain a hidden verifyCaptcha() function in the login handler that runs attacker-supplied commands as root, before any credential check, when the CAPTCHA field starts with a secret marker. 62 backdoored consoles were identified online on Nov 2-4, 2026 (26 in the U.S., 17 in Hong Kong, 7 in China), and CERT-In separately warns of the AI-assisted actor Crafty Falcon using ARTEX against Indian BFSI and crypto entities.

- **Published:** 2026-11-07T01:31:22Z
- **Last reviewed:** 2026-11-07T01:31:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5466
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5466.png
- **ID:** TL-2026-5466
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

ARTEX is an open-source, multi-agent AI-assisted penetration-testing framework with a planner-and-worker architecture. On 8 October 2026 its original author (GitHub: Autumn-27) took the project private. According to researcher Badbyte (badbyte.io), within hours a new Docker Hub account (tomicdd) was created (18:50 UTC) and a backdoored image pushed (19:41 UTC). A GitHub account (trhhubsd) then published a modified copy of the source (trhhubsd/ARTEX, reported at 2,449 stars and 600+ forks) containing a one-line change in docker-compose.yml (line 18, commit a4f4d38) that redirects the image from autumn27/artex to tomicdd/artex. The original repository was removed from GitHub, and a fork (imxv/ARTEXX) took over the fork network; 637 repositories were reported to still reference the malicious image.

The trojanized binary (/app/artex, layer 15 of the image) was built from upstream commit 5c0dbd4 plus uncommitted changes. Compared with official v0.3.15 it adds a 160-byte server.verifyCaptcha function, grows server.(*Server).authLogin by 512 bytes, and adds a fourth Captcha field to the login request struct. A single unauthenticated POST to /api/auth/login with a secret marker at the start of the captcha field causes the remainder to be executed through sh -c as root and the output to be returned in the response, before credentials are checked. The marker is withheld by the researcher. The compose file exposes port 8787 to the internet by default.

A compromised console gives the attacker the operator's API keys (Anthropic, OpenAI, Brave, Tavily), database and harvested target credentials, MITM proxy traffic including the CA private key, the JWT signing key (allowing forged 7-day admin tokens), and engagement targets and findings. The compromise therefore also exposes the data of ARTEX operators' victims. Badbyte counted 1,645 ARTEX consoles online on 4 November, of which 62 were identified as backdoored (46 still serving the backdoored build) and 590+ ran unversioned builds indistinguishable from rebuilt trojans. Backdoored consoles clustered at ColoCrossing (15 hosts in 104.168.63.0/24 sharing an SSH key) and a Hong Kong VPS network (7 hosts). First backdoored instance was seen on 20 October 2026. tomicdd/artex (about 9,000 pulls) and congdonglinux/artex were removed on 5 November.

Separately, CERT-In advisory CIAD-2026-0058 describes Crafty Falcon, an AI-assisted financial threat actor targeting BFSI, cryptocurrency exchanges and digital asset service providers with public AI offensive tools (ARTEX, PentAGI, Cairn, CyberStrikeAI). Reported access and post-exploitation behavior includes stolen hard-coded long-lived API tokens, forged-commit supply chain compromise, plaintext credentials in config files or source code, applications lacking MFA, reverse engineering of application code, unauthorized API calls through modified packages, Rs 1 micro-value test transactions before large transfers, log deletion, endpoint security tool tampering, cloud infrastructure command execution, abuse of payment aggregator settlement APIs, and exploitation of file-upload and deserialization flaws in PHP/Node.js applications. The sources do not establish that Crafty Falcon operates the backdoored images; the link is that ARTEX is among its tooling. Related public reporting (Zscaler ThreatLabz, CrowdStrike via BleepingComputer) documents other ARTEX operators, including a China-nexus actor tracked as Vapor Panda.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1195.002 Compromise Software Supply Chain
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1204.003 User Execution: Malicious Image
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1685 Disable or Modify Tools
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX Backdoor verifyCaptcha RCE - Root Shell Spawned by /app/artex** (`TL-2026-5466-SPL-001`)

TL-2026-5466: the trojanized ARTEX image (tomicdd/artex and clones) hides a verifyCaptcha() function in the /api/auth/login handler that passes attacker input to sh -c as root before any credential check. This search finds a POSIX shell started with -c whose parent is the /app/artex binary, the process-level footprint of the backdoor trigger (T1190, T1059.004).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.004
- **Data sources:** sysmon_for_linux, linux_process_creation, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype=sysmon:linux EventCode=1 earliest=-24h ParentImage="*/app/artex" Image IN ("*/sh","*/bash","*/dash","*/ash") CommandLine="* -c *" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host ParentImage | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFolderPath endswith "/app/artex"
| where FileName in~ ("sh", "bash", "dash", "ash")
| where ProcessCommandLine contains " -c "
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessSHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: ARTEX Backdoor Process Spawning Shell With -c (verifyCaptcha RCE)
id: 7b1d2f4e-3c6a-4e58-9a0f-1c2d3e4f5a61
status: experimental
description: Detects a POSIX shell started with -c whose parent is the /app/artex binary, the process footprint of the verifyCaptcha backdoor in trojanized ARTEX Docker images (tomicdd/artex and clones).
references:
  - https://badbyte.io/artex-backdoor-docker-image/
  - https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-07
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/app/artex'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/ash'
    CommandLine|contains: ' -c '
  condition: selection
falsepositives:
  - Legitimate ARTEX deployments (official builds) that run tooling through a shell
level: high
```

**Known false positives:**

- Official or self-built ARTEX deployments legitimately run pentest tooling through sh -c from /app/artex
- Authorized red-team engagements using ARTEX inside containers

**Tuning notes:** Index and sourcetype assume Sysmon for Linux (sysmon:linux). On a host known to run a clean ARTEX build, baseline normal child commands and exclude them; otherwise treat every hit as suspect until the image digest and /app/artex SHA256 (d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573) are verified. Prioritize hits with commands such as id, whoami, cat /etc/passwd or curl/wget.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Backdoored ARTEX Docker Image Pulled or Binary Executed (locked: unlock with TL Creds)
- Credential and API Key Harvesting on ARTEX Hosts (locked: unlock with TL Creds)
- Internet-Exposed ARTEX Console on Port 8787 and Backdoored-Host Range Contact (locked: unlock with TL Creds)
- ARTEX Backdoor Trigger - POST to [indicator] on Port 8787 (locked: unlock with TL Creds)
- AI Offensive Tool Execution (ARTEX, PentAGI, Cairn, CyberStrikeAI) (locked: unlock with TL Creds)
- DNS Query for [indicator] LLM Gateway Used by ARTEX Operators (locked: unlock with TL Creds)
- Log Deletion and Security Tool Tampering on ARTEX Hosts (locked: unlock with TL Creds)
- Traffic to ARTEX Operator Infrastructure and Backdoored Console Range (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `23.248.226[.]250`
- Domain: `xcai[.]pro`
- File hash: `d5070f52262effe216b840711343bff8f2787f39208d887d8dfd9c673f8d1573`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html)
- [ARTEX backdoor Docker image analysis (Badbyte)](https://badbyte.io/artex-backdoor-docker-image/)
- [Inside a Global AI-Assisted Hacking Campaign (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign)
- [Chinese hackers use ARTEX AI in automated attacks against 200 orgs (BleepingComputer)](https://bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs)
- [CERT-In: AI cyber gang targets banks, fintech firms (Deccan Chronicle)](https://www.deccanchronicle.com/nation/cert-in-ai-cyber-gang-targets-banks-fintech-firms-2001849)
- [India Says Hackers Used 4 Public AI Tools to Hit Fintechs](https://fourweekmba.com/ai-india-says-hackers-used-4-public-ai-tools-to-hit-fintechs/)
- [CERT-In Flags Unauthorised AI Agent Access To Indian Organisations' Systems (Inc42)](https://inc42.com/buzz/cert-in-flags-unauthorised-ai-agent-access-to-indian-organisations-systems/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5466