AI-Powered Attackers Weaponize Backdoored ARTEX; 62 Consoles Compromised

Indian authorities have identified a threat group, Crafty Falcon, leveraging AI-driven penetration testing tools to systematically target the country’s banking, financial services, and insurance sectors. The campaign employs readily available utilities like ARTEX, PentAGI, Cairn, and CyberStrikeAI to orchestrate rapid, autonomous attack chains that generate and adapt payloads in real time. Attackers have also struck cryptocurrency exchanges and digital asset platforms, stealing cryptographic keys and funds.

The intrusions exploit multiple entry points: stolen API credentials, compromised code repositories, plaintext passwords in configuration files, and applications lacking multifactor authentication. Once inside, attackers abuse legitimate API infrastructure to execute fraudulent fund transfers to mule accounts, deliberately running micro-transactions first to validate the attack path. They then obstruct detection by wiping logs and disabling endpoint protections. The speed and sophistication of these operations—including custom exploit development and reverse-engineering of targets—align with automated AI assistance.

After the original ARTEX repository was delisted due to malicious abuse, backdoored copies rapidly proliferated across GitHub and Docker Hub. The compromised variant modifies the Docker configuration to pull a malicious image containing hidden authentication-bypass logic in the login handler. When triggered by a specific marker in the CAPTCHA field, the handler executes submitted commands as root without credential verification. Researchers discovered 62 instances of the backdoored console online by early November, with 1,645 total ARTEX deployments identified globally. Multiple Docker Hub accounts continue distributing the same compromised image, enabling attackers to gain administrative control of any system running the tool.