[AUTO] ARTEX Docker Backdoor Distributed to 7,946 Instances

BadByte researchers discovered a backdoored ARTEX Docker image pulled 7,946 times by November 3. A hidden verifyCaptcha() function enables unauthenticated root command execution. The GitHub source remained clean; only the Docker Hub image was poisoned. By November 4, 62 vulnerable instances were confirmed.

The CERT-In advisory on CRAFTY FALCON, an AI-assisted threat actor targeting Indian BFSI, arrived the same week. News linked the discoveries, and CERT-In names ARTEX as a tool the actor uses. But neither the advisory nor BadByte research explicitly connects the backdoor to the actor. The tomicdd account responsible remains unconfirmed.

Registry-layer compromises bypass source-code verification. A clean GitHub repo offers no protection if the distributed binary is poisoned. CERT-In shared indicators only at restricted TLP levels, leaving public visibility incomplete.

Sources: ARTEX Backdoor: 7,946 Pulls of a Trojanized Docker Image Handing Out Root Shells • CERT-In Advisory CIAD-2026-0058

Coverage: CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access • Machine-Speed Financial Theft: CERT-In Names “CRAFTY FALCON” as AI-Assisted Threat Actor