CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

CERT-In warns of an active, AI-assisted threat actor dubbed 'Crafty Falcon' targeting Indian BFSI firms, fintechs and cryptocurrency platforms using publicly available AI offensive tools to automate tailored attack chains, steal API credentials and invoke fund-transfer APIs from allow-listed infrastructure; post-compromise actions include log deletion, endpoint tampering, cloud pivoting and abuse of payment/settlement APIs. The advisory also highlights a malicious backdoored ARTEX Docker image that grants an unauthenticated root shell and has been widely distributed, and it points to CERT-In's new AI security auditing guidelines to harden AI agent governance and controls.