CERT-In names AI actor 'Crafty Falcon'; ARTEX Docker image backdoored

India's CERT-In issued a Critical advisory, CIAD-2026-0058, on November 4, 2026, naming an AI-assisted threat actor it tracks as "Crafty Falcon" targeting the country's banking, financial services and insurance (BFSI) sector. The advisory, from the finance-sector team CSIRT-Fin, updates CIAD-2026-0046 (October 9) on actors abusing payment and disbursement APIs for unauthorized fund transfers. Separately, a researcher found that one of the open-source offensive tools CERT-In names — ARTEX — is circulating on Docker Hub as a backdoored image that hands out an unauthenticated root shell.

What CERT-In describes

Per CSIRT-Fin, as reported by The Hacker News and Inc42, the actor:

• Uses AI to survey targets, then invokes victims' own payment and disbursement APIs to move funds.
• Abuses cloud services — reporting cites AWS Systems Manager and Lambda — to run commands and deploy files.
• Deletes logs, tampers with EDR tooling, and runs anti-forensic cleanup.

CERT-In names four publicly available offensive tools in the actor's kit: ARTEX, PentAGI, Cairn and CyberStrikeAI. ARTEX is described as an open-source multi-agent AI penetration-testing and command-and-control platform.

Hedge the attribution: CERT-In's own advisory does not establish that every incident in the campaign was carried out by Crafty Falcon, and it does not say how many Indian organizations were hit. This is an advisory about a pattern of activity and tooling, not an indictment.

The backdoored ARTEX image

The supply-chain angle comes from independent researcher Badbyte, whose analysis The Hacker News relays. After ARTEX's original GitHub repository was pulled, copies spread to GitHub and Docker Hub. One Docker image — tomicdd/artex, downloaded roughly 9,000 times per Docker Hub stats — carries a hidden verifyCaptcha() function added to the login handler. If the CAPTCHA field begins with a secret marker, the rest of the input runs through sh -c as root and returns output before any credential check — in Badbyte's words, "an unauthenticated root shell on every install." A reported-identical copy, congdonglinux/artex, behaves the same.

The numbers, per Badbyte's scanning:

• 62 consoles served the backdoored build between November 2 and 4, 2026 — 26 in the US, 17 in Hong Kong, 7 in China.
• The first such instance appeared by October 20, twelve days after the image was pushed.
• 1,645 hosts were serving an ARTEX console as of November 4; the analysis does not say how many of those run the backdoored build.

This is one researcher's work; no CVE is assigned, and the writeup does not publish file hashes or the secret marker, so there is no verbatim detection block to copy. Treat the operator-side exposure as a strong lead, not a settled count.

Action checklist

1. Hunt for unsanctioned offensive AI tooling on your infrastructure — ARTEX, PentAGI, Cairn, CyberStrikeAI — and alert on downloads of them, as CERT-In recommends.
2. If you run ARTEX from a container, do not pull tomicdd/artex or congdonglinux/artex; rebuild from source you control and audit docker-compose.yml for substituted image references.
3. Monitor AI coding-agent processes running with permission checks disabled, a behavior CERT-In flags.
4. BFSI operators: watch for anomalous use of your own payment and disbursement APIs, and preserve logs — CERT-In asks for reports with logs at incident@cert-in.org.in.
5. Review AWS Systems Manager and Lambda execution and IAM for the abuse pattern described.

Context

Two threads meet here. One is the maturing use of agentic AI tooling by financially motivated actors — the reason this beat warrants extra skepticism, since much of the surrounding coverage is hype. The other is older and duller: a pentest tool, pulled from its origin and re-hosted on a public registry, becomes a backdoor-delivery vehicle. Offensive security tooling has always been dual-use; shipping it through Docker Hub just industrializes the compromise of the people who deploy it.