CERT-In Flags AI-Driven Attacks Using Backdoored ARTEX Image
Original title: CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
CERT-In discloses active attacks by the Crafty Falcon gang targeting India's BFSI sector and crypto firms with AI tools like ARTEX, while a modified Docker image for the tool grants root shell on every unauthenticated…
CERT-In has disclosed an ongoing campaign by the AI-assisted threat actor Crafty Falcon targeting organizations in India's Banking, Financial Services and Insurance sectors along with cryptocurrency exchanges. The group leverages open-source tools such as ARTEX, PentAGI and others to autonomously execute attack chains at machine speed. Attackers have stolen API credentials and used fund-transfer APIs to move funds to mule accounts while erasing logs and tampering with security tools. Separately, copies of the ARTEX tool on Docker Hub contain a backdoor that, when triggered by a specific CAPTCHA marker, executes shell commands as root without any credential check.
Unconfirmed: Exact number of consoles exposed differs between researcher claim of 9,000 downloads and item headline reference to 62 consoles; repo takedowns and copycat availability status not fully confirmed.
- ARTEX image downloaded 9,000 times from Docker Hub
- Modified docker-compose.yml pulls backdoored tomicdd/artex image
- Backdoor grants root shell on unauthenticated login endpoint
- Attackers delete logs and tamper with endpoint security tools
- AI tools generate and refine custom attack scripts rapidly
Impact: Unauthenticated root shell access to ARTEX instances
| Product | Affected |
|---|---|
| Docker ARTEX | — |
- Products
- ARTEX
- Threat actors
- Crafty Falcon
- Organizations
- CERT-In
- Countries
- India
From the original article
5 min read at thehackernews.com
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.