Crafty Falcon targets finance as ARTEX backdoor exposes consoles
CERT-In says Crafty Falcon is actively attacking Indian financial and digital-asset organizations, while The Hacker News reports a separate backdoored ARTEX Docker image exposed 62 consoles to root access.
CERT-In says the attackers use artificial intelligence (AI) tools to quickly generate and adjust scripts based on a target’s responses. Its report also describes attackers stealing payment and partner-bank API credentials, then calling transfer APIs from infrastructure the organizations already allow—bypassing application-level checks. The ARTEX image presents a different route to compromise: exposed consoles can be accessed with root-level privileges.
For a financial firm, stolen API credentials can turn trusted internal infrastructure into a path for unauthorized transfers. For an organization running ARTEX, the backdoored image creates a separate root-access risk; the reporting does not establish that the 62 exposed consoles belong to the targeted firms.