CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

CERT-In said Crafty Falcon is an active, ongoing threat targeting Indian Banking, Financial Services, and Insurance organizations. The group has also targeted cryptocurrency exchanges and digital asset providers, stealing keys and funds. Its use of AI-assisted tools makes attacks faster and more adaptable.

The tools named by CERT-In include ARTEX, PentAGI, Cairn, and CyberStrikeAI. They can execute complete attack chains autonomously, produce many tailored scripts quickly, and change payloads after observing a target’s response. Supporting infrastructure can rotate its IP addresses within hours to days.

This matters because defenders may face many changing attacks rather than one fixed method. CERT-In also observed custom scripts being created and improved rapidly, a pattern consistent with AI-assisted development. The activity remains active, while the agency is promoting stronger AI governance, testing, monitoring, human oversight, and incident response.

A backdoor is a hidden or unauthorized method of entering software or a system while bypassing its normal authentication. If it provides a root shell, the intruder receives command-line access with the highest operating privileges, allowing powerful changes to the system.

The provided source identifies copycat ARTEX repositories and says the heading refers to a copy handing an unauthenticated user a root shell. However, the excerpt ends during the sentence introducing an independent researcher’s findings. It does not describe the altered code, the request path, or the precise flaw that produced the shell.

Therefore, the exact mechanism cannot be established from the supplied text. The reported risk is clear: a modified penetration-testing tool could become a delivery vehicle for unauthorized privileged access. The source does not provide enough detail to attribute that behavior to a specific function or vulnerability.

The source establishes that ARTEX copies appeared on GitHub after the original repository was taken down. It names three copycat repositories and notes that the first two were no longer available for download. It also mentions a Docker Hub copy associated with one repository.

However, the excerpt ends at “According to an independent c” and does not include the researcher’s measurements. No figure states how many ARTEX consoles were exposed to root access. No figure states how many times the malicious Docker image was downloaded.

Those two quantities therefore cannot be answered reliably from the supplied article text. Inferring them from the number of repositories would be incorrect, because repository count, exposed-console count, and image-download count measure different things. The missing continuation would be needed to provide the requested figures without speculation.

Attackers who obtain payment API credentials can call payment aggregators, gateway, partner-bank, or merchant-settlement APIs directly. This can move money even when application checks expect requests from a legitimate client. The article says attackers used allow-listed infrastructure to invoke fund-transfer APIs.

Compromised cloud infrastructure can execute commands and deploy malicious payloads. Public non-production environments can reveal shared credentials, tokens, or network paths that help attackers pivot into production. Attackers may reverse-engineer code, modify application packages, exploit file-upload or deserialization flaws, and create web shells.

The financial result can be rapid transfers to attacker-controlled mule accounts across multiple banks. Attackers may first send tiny test payments, then make larger transfers. They also delete logs and tamper with endpoint security tools, making detection and incident response more difficult.

API tokens, credentials, and source-code access are often trusted as proof that a request is authorized. Long-lived hard-coded tokens can remain usable after theft. Exposed credentials can be copied from configuration files, code, or databases. Missing MFA makes application and remote-service access easier to take over.

Forged commits can compromise the software supply chain, while stolen credentials can let attackers operate inside trusted systems. Attackers may then call payment APIs directly, rather than following the normal application workflow. Modified application packages can also make unauthorized calls that controls assumed only the legitimate client would make.

This bypasses safeguards such as loan creation, KYC, sanction, beneficiary verification, balance sufficiency, and per-transaction limits. The article says fraudulent transactions can be executed rapidly and routed through mule accounts. The central weakness is misplaced trust in tokens, software, locations, or clients.

A micro-value transaction, such as Rs. 1, tests whether an unauthorized payment route works. It can confirm that credentials, API permissions, beneficiary details, and fund flows are usable before attackers risk larger transfers. This gives the operators quick feedback from the target system.

Once the route is validated, fraudulent transactions can move money into attacker-controlled mule accounts across multiple banks. Attackers may abuse merchant settlement APIs or payment-transfer APIs. The article says these transactions are executed rapidly, helping the operators shift funds before defenders respond.

To reduce visibility, operators delete logs and tamper with endpoint security tools. That can remove evidence, disrupt alerts, and complicate investigation and response. Together, testing, rapid movement, and defensive interference form a practical sequence: validate the path, transfer funds, and make discovery harder.

Least privilege means giving an AI agent only the permissions, tools, and data needed for its approved objective. Human approval means a person must authorize consequential actions. Emergency interruption means high-risk systems can be stopped, have credentials revoked, and be prevented from restarting automatically.

CERT-In’s guidelines require testing an agent’s identity, objectives, tool use, permission boundaries, and adherence to least privilege. They also call for human approval and emergency controls in high-risk AI systems. These checks create limits around autonomous behavior.

The safeguards matter because the article describes tools that execute attack chains autonomously, generate scripts rapidly, and adapt payloads to target responses. Without boundaries, an agent could act at machine speed with excessive access. Governance, monitoring, incident response, and accountability help organizations detect misuse and interrupt harmful actions.