# SZB-9fb3d806b5: CERT-In flags backdoored ARTEX exposing 62 consoles to root access

The headline reports that a backdoored ARTEX exposes 62 consoles to root access, but the visible text is cut off before those details appear.

- Type: Early warning
- Kind: Malicious package
- Vendor: ARTEX
- Status: Reported, not confirmed
- Sources: 1 distinct
- First seen: 2026-11-05 09:34 UTC

> No statement or filing from ARTEX has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The headline reports that a backdoored ARTEX exposes 62 consoles to root access, but the visible text is cut off before those details appear. The visible text says CERT-In reports that the AI-assisted threat actor Crafty Falcon is actively targeting Indian banking, financial services and insurance organizations.

## What to do

- Check whether ARTEX software or consoles are deployed in your environment
- Restrict console access and rotate privileged credentials if ARTEX is in use
- Review ARTEX console logs for unexpected root-level activity
- Follow CERT-In advisories for updates on the backdoor

## Timeline

- 2026-11-05 08:42 UTC: Made public by The Hacker News
- 2026-11-05 09:34 UTC: First seen by cve.now

## Evidence (1 source)

- 2026-11-05 · Press · [The Hacker News](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html): “The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-9fb3d806b5&body=https%3A%2F%2Fcve.now%2FSZB-9fb3d806b5%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-9fb3d806b5

### Has ARTEX confirmed it?

The Hacker News reports it. No statement from ARTEX has reached cve.now yet.

Source: https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html

### What should ARTEX users do?

Check whether ARTEX software or consoles are deployed in your environment. Restrict console access and rotate privileged credentials if ARTEX is in use. Review ARTEX console logs for unexpected root-level activity. Follow CERT-In advisories for updates on the backdoor.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-9fb3d806b5
Site guide for agents: https://cve.now/llms.txt