---
title: "CERT-In Crafty Falcon: AI Attacks on Indian BFSI"
url: https://playciso.com/blog/cert-in-crafty-falcon-backdoored-artex-fork
updated: 2026-11-05
section: Blog
publisher: PlayCISO
---

# CERT-In Crafty Falcon: AI Attacks on Indian BFSI

> CERT-In says AI-assisted Crafty Falcon targets Indian BFSI with ARTEX and other tools. Separately, backdoored ARTEX copies surfaced. Confirmed vs claimed.

Source: https://playciso.com/blog/cert-in-crafty-falcon-backdoored-artex-fork · Published: 2026-11-05 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058

---

On **4 November 2026** (updated 5 November) India's national CERT, **CERT-In**, published a **Critical** advisory on an AI-assisted financial threat actor its CSIRT-Fin team calls **CRAFTY FALCON**. It says the actor targets Indian lenders, fintechs, payment firms and crypto exchanges, uses AI offensive tools including **ARTEX, PentAGI, Cairn and CyberStrikeAI**, and moves money through the victims' own payment APIs. The same day, researcher **Badbyte** reported that a popular copy of ARTEX shipped a root backdoor. These are two separate findings; no source we read connects them.

**Who this is for:** CISOs and heads of security at banks, NBFCs, fintechs, payment and crypto firms, plus anyone who runs open-source offensive tooling.

*We read CERT-In's advisories CIAD-2026-0058 and CIAD-2026-0046, Badbyte's write-up and The Hacker News report on 5 November 2026. We could not open the PDF of CERT-In's AI auditing guideline, so what we say about it is attributed to The Hacker News. We did not run any of these tools. PlayCISO is not affiliated with CERT-In, Badbyte or any project named. This post gives no commands, no trigger details and no hosts, addresses or hashes.*

Confirmed vs not yet known

**Confirmed on CERT-In's public pages:** CIAD-2026-0058, "Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON", Critical, issued 4 November and updated 5 November 2026, updates CIAD-2026-0046 of 9 October 2026. It says the campaign is ongoing, that some already-remediated entities were attacked again, and that attacks often fall on holidays, weekends and other low-monitoring periods. It lists ARTEX, PentAGI, Cairn and CyberStrikeAI among the tools seen. The public version has no indicators of compromise; CERT-In says full IOCs are in a restricted (TLP) version.

**Confirmed on Badbyte's write-up:** the backdoored image was pushed to Docker Hub on 8 October 2026, hours after ARTEX's author said the project would close its source; the first backdoored console appeared by 20 October; 62 consoles served it between 2 and 4 November; about 1,645 ARTEX consoles were live on 4 November. Badbyte says the backdoor gives unauthenticated root command execution through the login handler.

**Reported by The Hacker News, not found on a page we read:** the split of the 62 consoles (26 US, 17 Hong Kong, 7 China), the 2,449 stars and 600-plus forks on the GitHub copy, and "about 9,000" pulls (Badbyte gives 7,946 by 3 November). The guideline summary comes from The Hacker News too.

**Counts to read carefully:** 62 and 1,645 are scan counts of exposed consoles. They are not victims of Crafty Falcon, and they are not a count of attacks.

**Not yet known:** whether Crafty Falcon ever used a backdoored copy (nothing says so), how many financial firms were hit or lost money (the public advisory gives no numbers), who runs the trojanized image, and whether Crafty Falcon is the same cluster as any other vendor tracks. We do not link them.

## What CERT-In says about Crafty Falcon

CIAD-2026-0058 says Crafty Falcon uses AI tools to scan targets, then abuses the victim's payment and disbursement APIs. The Hacker News quotes CERT-In as saying the tools can "execute complete attack chains autonomously at machine speed", and that "the supporting attack infrastructure rotates IP addresses within hours to days". Behaviours the public advisory lists:

- Cloud abuse: use of cloud management and serverless services for remote command execution and file deployment.

- Exposed test environments: entry through internet-reachable UAT, staging or test systems, then movement to production.

- Tampered apps: reverse-engineered client apps and altered packages used to call APIs that assumed only the genuine client would.

- Test then drain: micro-value test transactions (for example Rs. 1) before large transfers, and abuse of payment-aggregator merchant settlement APIs.

- New exploits fast: rapid use of newly published file-upload and deserialization flaws that lead to PHP and Node.js web shells.

- Crypto: theft of wallet keys.

- AI fingerprints: bursts of newly created, commented script variants in web roots and temp directories, and LLM API traffic from non-development servers.

The October advisory, CIAD-2026-0046, "Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities", describes the money path: attackers compromise internet-facing apps, exposed APIs and privileged endpoints, steal payment-gateway and partner-bank API credentials, then call fund-transfer APIs from the entity's own allow-listed infrastructure. That skips loan, KYC, sanctions, beneficiary, balance and limit checks, and sends funds to mule accounts at several banks. CERT-In says some indicators point to AI-assisted tooling and that the time from first compromise to theft has shortened.

## The backdoored ARTEX copies

Per Badbyte, ARTEX's author announced on 8 October that the project was going closed source. Hours later a Docker Hub account pushed a trojanized image, and a GitHub copy changed one line of its compose file to pull it. The GitHub copy was later deleted, but the image, and a fork network that still referenced it, stayed. Badbyte says the build hides a routine in the login handler that gives an unauthenticated caller a root command shell before any credential check, and that it does not phone home. The data and configuration volumes that survive an image update are what keep it there.

Why it matters: an ARTEX console holds other people's secrets. Badbyte says a compromised one holds a team's unpatched findings, live credentials, captured sessions and network position, and the operator can alter the agent's behaviour on later runs. In The Hacker News' paraphrase of the researcher, the people running it "did not sign up for a root shell on their own server".

The earlier ARTEX story is in our [GTIG post](/blog/artex-agentic-offensive-frameworks-gtig), and the exposed-console angle is in [what to hunt](/blog/ai-pentest-harness-consoles-exposed-what-to-hunt) and [AntiFox](/blog/antifox-artex-fork-exposed-consoles). **Nothing we found shows that AntiFox, T3MP3ST or Sapper are backdoored.** Badbyte names only two Docker Hub images as carrying the backdoor. AntiFox calls itself a fork of ARTEX, so check what any copy you hold was built from.

## Timeline

| Date | Event | Source |
| --- | --- | --- |
| 8 October 2026 | ARTEX author says the project goes closed source; hours later a trojanized image is pushed to Docker Hub | Badbyte |
| 9 October 2026 | CERT-In issues CIAD-2026-0046 on API-based fund-transfer theft from NBFCs, fintechs and wallet operators | CERT-In CIAD-2026-0046 |
| By 20 October 2026 | First console serving the backdoored build seen | Badbyte |
| 23-24 October 2026 | A GitHub issue raising suspicion of a backdoor is opened and closed | Badbyte |
| 30 October 2026 | GTIG and Mandiant publish "ARTEX and Friends" | GTIG |
| 2-4 November 2026 | 62 consoles seen serving the backdoored build; 46 still did at 09:55 UTC on 4 November | Badbyte |
| 4 November 2026 | CERT-In publishes CIAD-2026-0058 (Crafty Falcon) and its AI Security Auditing Guidelines; Badbyte publishes its write-up | CERT-In, CERT-In guidelines page, Badbyte |
| 5 November 2026 | The Hacker News reports both; CERT-In pages show an update the same day | The Hacker News |

## Reported indicators (verify before blocking)

These names come from The Hacker News and Badbyte. We did not confirm them ourselves, and our fetch of Docker Hub's tomicdd/artex page returned "not found", which does not tell you whether the image is gone. Use Badbyte's own indicator list, which includes digests, for anything you act on, and check each name against your own asset inventory first. A name appearing here does not mean a project is malicious: Badbyte says about 34 Docker Hub namespaces publish "artex" images and only two carried the backdoor.

| Name | What was reported | Source |
| --- | --- | --- |
| Docker Hub: tomicdd/artex | Backdoored image, 8 October push | Badbyte, The Hacker News |
| Docker Hub: congdonglinux/artex | Backdoored, identical to the first | Badbyte, The Hacker News |
| GitHub: trhhubsd/ARTEX (ARTEXX variants) | Copy whose compose file pulled the backdoored image; deleted | Badbyte, The Hacker News |
| GitHub: mhtsec/ARTEX, RuoJi6/ARTEX | Reported ARTEX copies; the first is no longer available. The reports do not say these carry the backdoor | The Hacker News |
| Other Docker Hub names with "artex" | mianhuatang11, autumn26, andy1099zz, dgddw, ylh440104 namespaces named as publishing ARTEX images. Not reported as backdoored | The Hacker News |

## What security leaders should do this week

### If you run a bank, lender, fintech, payment or crypto firm

- Take the API inventory. List every payment, disbursement and settlement API, retire the unused ones and find the credentials each holds. Start with the [API security hub](/tools/api-security-hub).

- Kill static tokens. Replace long-lived hard-coded tokens with short-lived, session- or workload-bound credentials from a secrets manager or HSM, and scan code, config files and databases for plaintext secrets. Supply-chain compromise by forged commits is on CERT-In's list of entry routes, so protect source repositories too.

- MFA everywhere: payment platforms, admin portals, bank APIs and remote services. CERT-In lists services without MFA as an entry point.

- Watch the money path. Alert on micro-value test transfers followed by large ones, new beneficiaries, velocity and cumulative limits, and settlement-API changes, with automatic holds. Add maker-checker on fund movement. Do not rely on app-level checks alone: CERT-In says they were bypassed by calling the APIs directly.

- Protect the logs and the sensors. Centralise logs off the servers, keep long retention (CERT-In's October advisory says at least 180 days), and alert on log deletion and on any tampering with EDR.

- Isolate non-production. Remove internet exposure from test, staging and UAT environments and break any trust path from them to production.

- Do not trust the client. Assume modified app packages will call your APIs; bind calls to server-side session state and validate every transaction server-side.

- Staff the weekend. CERT-In says attacks cluster in low-monitoring periods. Lower alert thresholds and add cover then. Run the [Agentic Attack Readiness Scorecard](/tools/agentic-attack-readiness) and plant canary credentials with the [honeytoken planner](/tools/honeytoken-placement-planner). Report incidents to CERT-In at incident@cert-in.org.in, as the advisory asks.

### If you or a vendor ran a copy of ARTEX or another pentest framework

- Check provenance. Look for the image names in the indicators table and for any compose file that pulls from an unvetted source. Compare image digests with Badbyte's published list. Do not try to trigger the backdoor on anything you do not own.

- Treat an unvetted instance as compromised. Stop it, isolate the host and keep its volumes for forensics but do not reuse them.

- Rotate everything it could reach: model provider keys, database passwords, webhook and bot tokens, mail and proxy credentials, MCP tokens, session-signing keys.

- Review what it touched: the targets and credentials it held, and any changes to agent prompts, skills and tool definitions. If it was pointed at a client or third party, think about telling them.

- Run such tools safely from now on: only from an upstream release you have verified, pinned by digest, on an isolated network, never as root, and never on an open port. Our [exposure scanner](/tools/agent-exposure) checks hosts you own, and the [egress containment lab](/tools/agent-egress-containment-lab) practises cutting off an agent's outbound access.

- Ban unauthorised offensive tools and require written authorisation for testing, as CERT-In's advisory does. Monitor LLM API traffic from servers that should not make it.

### For AI governance

CERT-In's AI Security Auditing Guidelines (as summarised by The Hacker News; read the PDF first) ask an auditor to test an AI agent's documented identity, authorised objectives, approved tools, permission boundaries and least privilege, to require human approval for consequential actions, and for high-risk systems to provide emergency interruption, credential revocation and controls against automatic restarts. Our mapping to tools you can use today, which is our reading and not CERT-In's text:

- Governance and an AI management system: ISO/IEC 42001 asks for this. Start with the [Annex A guide](/tools/iso-42001-annex-a-guide) and the [AI governance pack](/tools/ai-governance-pack).

- Permission boundaries and least privilege: scope each agent's task with the [task permission scoper](/tools/agent-task-permission-scoper) and test credential handling in the [credential broker lab](/tools/agent-credential-broker-lab).

- Human approval for consequential actions: practise it in the [step-up approval lab](/tools/agent-step-up-approval-lab).

- Emergency interruption and revocation: drill it with the [kill-switch drill lab](/tools/agent-kill-switch-drill-lab).

- Auditability and response: check your evidence with [AI audit readiness](/tools/ai-audit-readiness) and plan for the day an agent misbehaves with the [AI incident response checklist](/tools/ai-incident-response-checklist).

## Where this fits

Two ARTEX lessons now sit side by side. Attackers use these frameworks at machine speed against valid credentials and normal APIs, so controls should not depend on the attacker being slow or clumsy. And the defenders and testers who run the same tools are a target: a console full of other people's secrets is worth backdooring. Our [agentic pentesting master guide](/blog/agentic-pentesting-systems-master-guide) covers how to choose and govern these tools.

## Frequently asked questions

### What is Crafty Falcon?

Crafty Falcon is the name CERT-In's financial-sector team (CSIRT-Fin) gives to an AI-assisted financial threat actor. In advisory CIAD-2026-0058 (4 November 2026, updated 5 November) CERT-In says it targets NBFCs, digital lenders, fintechs, payment aggregators and payment service providers, and crypto exchanges, uses AI tools to scan targets, then abuses the victim's own payment and disbursement APIs to move funds. The name is CERT-In's own tracking name; we found no source linking it to another vendor's cluster.

### Which AI tools does CERT-In say the actor uses?

The advisory lists ARTEX, PentAGI, Cairn and CyberStrikeAI among the AI offensive tools seen, alongside rotating attack infrastructure and LLM API traffic from servers that are not development machines. The listing says the tools were seen in the activity. It does not say which tool did what in which incident.

### Did Crafty Falcon use the backdoored ARTEX copies?

No source says so. The two stories were published together by The Hacker News, but CERT-In's advisory does not mention a backdoored image, and Badbyte's write-up does not mention CERT-In or Crafty Falcon. Treat them as two separate findings about the same tool family.

### What does "62 consoles" mean?

Badbyte says 62 ARTEX consoles were seen serving the backdoored build between 2 and 4 November 2026, and that 46 still ran it at 09:55 UTC on 4 November. That is an internet-scan exposure count of operators who ran a trojanized copy. It is not a count of victims of Crafty Falcon, and the operators of those consoles are themselves the people the backdoor put at risk. The 1,645 figure is the number of ARTEX consoles Badbyte saw live on 4 November, backdoored or not.

### What did the backdoor do?

Per Badbyte, the modified build hides a routine in the login handler that gives an unauthenticated caller a command shell running as root, before any credential check. Badbyte says it does not phone home, and that what a compromised console holds (stored secrets, captured traffic, target data and agent settings) is the real prize. We do not publish the trigger or the request format.

### Which images and repositories were reported?

Badbyte and The Hacker News name the Docker Hub images tomicdd/artex and congdonglinux/artex as backdoored, and a GitHub copy (trhhubsd/ARTEX, since deleted) whose compose file pulled the first one. Badbyte says 637 GitHub repositories still pointed at the backdoored image on 5 November. Other Docker Hub namespaces publish images with "artex" in the name; Badbyte says only two carried the backdoor. See the indicators section and verify before you block anything.

### How many people pulled the backdoored image?

Sources differ. Badbyte counts 7,946 pulls by 3 November (7,913 for tomicdd/artex and 33 for congdonglinux/artex). The Hacker News says about 9,000 downloads for tomicdd/artex. We use Badbyte's figure as the primary and note the difference. Pull counts include repeat pulls and automation, so they are not a count of installs.

### I ran a copy of ARTEX. What do I do?

Treat any instance that came from an unvetted repository or image as compromised until proven otherwise. Check the image name and digest and where your compose file pulls from, stop and isolate the host, do not reuse its data volumes, rotate every credential it could reach (model API keys, database, webhooks, session-signing material), and review what it touched. Rebuild only from a source you have read, pinned by digest, on an isolated network.

### Are AntiFox, T3MP3ST or Sapper backdoored?

Nothing we found says so. Badbyte's write-up names only the two Docker Hub images above as carrying the backdoor and does not mention AntiFox, T3MP3ST or Sapper. AntiFox describes itself as a fork of ARTEX, so check where any copy you hold was built from. That is a reason to verify provenance, not evidence of a backdoor.

### What does the CERT-In AI audit guideline require?

CERT-In published "Artificial Intelligence (AI) Security Auditing Guidelines" on 4 November 2026. We could not open the PDF, so we rely on The Hacker News' summary: it covers governance, security, privacy, fairness, transparency, resilience and auditability, asks auditors to test an agent's identities, authorised objectives, approved tools, permission boundaries and least privilege, expects human approval for consequential actions, and, for high-risk systems, emergency interruption, credential revocation and controls against automatic restarts. Read the PDF before you write it into a policy.

### Does this matter outside India?

The behaviours do. Static API tokens, non-production environments reachable from the internet, fund-transfer APIs that trust their own network and apps that assume only the official client calls them are the same weaknesses anywhere. And any team that runs open-source offensive tooling should check where it came from.

## Sources

- [CERT-In CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON (4 November 2026, updated 5 November); accessed 5 November 2026](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058)

- [CERT-In CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities (9 October 2026, updated 5 November); accessed 5 November 2026](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0046)

- [CERT-In: Artificial Intelligence (AI) Security Auditing Guidelines (4 November 2026); listing page accessed 5 November 2026, PDF not opened](https://www.cert-in.org.in/s2cMainServlet?pageid=GUIDLNVIEW02&refcode=CISG-2026-04)

- [Badbyte: write-up on the backdoored ARTEX Docker image (4 November 2026); accessed 5 November 2026](https://badbyte.io/artex-backdoor-docker-image/)

- [The Hacker News, Ravie Lakshmanan: CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access (5 November 2026); accessed 5 November 2026](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html)

- [Docker Hub: mianhuatang11/artex (page exists; not reported as backdoored); accessed 5 November 2026](https://hub.docker.com/r/mianhuatang11/artex)

- [Google GTIG and Mandiant: ARTEX and Friends: Enter Agentic Offensive Frameworks (30 October 2026)](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks)