CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

The Indian Computer Emergency Response Team (CERT-In) has warned that an AI-assisted threat group, known as Crafty Falcon, is targeting financial organizations across India. This ongoing threat involves the use of artificial intelligence-driven offensive security tools, such as ARTEX, PentAGI, Cairn, and CyberStrikeAI, which autonomously execute complete attack chains and adapt their payloads based on target responses.

The supporting attack infrastructure frequently rotates IP addresses, making detection challenging. CERT-In has also reported that these attacks have targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of keys and funds. The agency noted that these attacks bypass traditional security measures, including application-level controls, to steal payment aggregator/gateway and partner-bank API credentials, and execute fraudulent transactions to move funds to attacker-controlled mule accounts.

CERT-In has also urged organizations to implement the Artificial Intelligence Security Auditing Guidelines, which require thorough testing of AI agents, human approval for consequential actions, and high-security standards for high-risk AI systems. The abuse of open-source penetration testing tools, like ARTEX, has led to the creation of a backdoored version that grants a root shell during unauthenticated requests, a vulnerability that has been downloaded 9,000 times.

As of November 4, 2026, 62 ARTEX consoles on the internet were found to be serving the backdoored build, with the majority located in the U.S., Hong Kong, and China.