---
title: "[AUTO] ARTEX Docker Backdoor Distributed to 7,946 Instances"
pubDatetime: 2026-11-05T15:29:00.000Z
description: "Backdoored ARTEX Docker image reached 7,946 instances via poisoned registry, 62 confirmed deployments detected."
tags: [vulnerability, supply-chain, incident-response, 2026, 2026-q4, 2026-11, AUTO]
---
[BadByte researchers](https://badbyte.io/artex-backdoor-docker-image/) discovered a backdoored ARTEX Docker image pulled 7,946 times by November 3. A hidden `verifyCaptcha()` function enables unauthenticated root command execution. The GitHub source remained clean; only the Docker Hub image was poisoned. By November 4, 62 vulnerable instances were confirmed.

The [CERT-In advisory](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058) on CRAFTY FALCON, an AI-assisted threat actor targeting Indian BFSI, arrived the same week. News linked the discoveries, and CERT-In names ARTEX as a tool the actor uses. But neither the advisory nor BadByte research explicitly connects the backdoor to the actor. The `tomicdd` account responsible remains unconfirmed.

Registry-layer compromises bypass source-code verification. A clean GitHub repo offers no protection if the distributed binary is poisoned. CERT-In shared indicators only at restricted TLP levels, leaving public visibility incomplete.

---

*Sources: [ARTEX Backdoor: 7,946 Pulls of a Trojanized Docker Image Handing Out Root Shells](https://badbyte.io/artex-backdoor-docker-image/)  •  [CERT-In Advisory CIAD-2026-0058](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058)*

*Coverage: [CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html)  •  [Machine-Speed Financial Theft: CERT-In Names "CRAFTY FALCON" as AI-Assisted Threat Actor](https://ministryofcyberaffairs.com/news/machine-speed-financial-theft-cert-in-names-crafty-falcon-as-ai-assisted-threat-actor-escalates-attacks-on-bfsi-entities-a4e07bb0-a14b-46eb-bb1c-a9610f19f883)*

*Related on this blog: [[AUTO] Security Tools as First-Strike Targets](/posts/auto-litellm-trivy-supply-chain)  •  [[AUTO] Malware campaigns weaponize AI platform trust](/posts/auto-ai-malware-delivery)  •  [[AUTO] PhantomRaven: Stealing Secrets for Bug Bounties](/posts/auto-phantomraven-bounty-stealer)*