Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
Threat actor
Crafty Falcon
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenNov 5, 2026
- Last mentioned2h ago
Timeline
5 articles · newest firstARTEX AI tool used in more campaigns than reported, Censys finds
Censys analysis reveals 1465 exposed ARTEX consoles worldwide, with 10.6% also running other threat artefacts.
65
CRAFTY FALCON targets Indian fintechs on weekends
CERT-IN names actor CRAFTY FALCON and warns of active AI-powered attacks timed to low-monitoring periods.
65
CERT-In warns Crafty Falcon is hitting Indian fintech and crypto firms
The actor moves from exposed non-production systems into production, then tests Rs. 1 transfers before larger thefts.
74
CERT-In Flags AI-Driven Attacks Using Backdoored ARTEX Image
CERT-In discloses active attacks by the Crafty Falcon gang targeting India's BFSI sector and crypto firms with AI tools like ARTEX, while a modified Docker image for the tool grants root shell on every unauthenticated…
65
Related CVEs
by mentions- Out-of-bounds write in Zyxel GS1900-24E CGI up to 2.90(AAHK.2)C0
- CVE-2026-1231581%8.1Password bypass in OpenSSH before 10.6p2 on musl without PAM
- CVE-2026-109518<1%7.7Man-in-the-middle RCE in APT on Debian and Ubuntu
Appears with
- CERT-Inorganization · 3
- CERT-Invendor · 2
- Microsoftvendor · 2
- ARTEXproduct · 2
- CyberStrikeAIproduct · 1
- digital lending platformsvictim · 1
- South Korean financial institutionsvictim · 1
- Zyxelvendor · 1
- OPSSHIELDvendor · 1
- XLaborganization · 1
- GS1900product · 1
- OpenSSHproduct · 1
- CWPdoormalware · 1
- APTproduct · 1
- SIXZUTmalware · 1
- financial and cryptocurrency organizationsvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.