ARTEX Penetration Testing Tool: Backdoored Docker Images

CERT-In reported that backdoored versions of the ARTEX penetration testing console, distributed via Docker Hub, are being used to grant attackers unauthenticated root shell access. The malicious routine injects a hidden verifyCaptcha() function into the login handler, which executes input via sh -c as root if a specific secret marker is detected in the CAPTCHA field. As of November 4, 2026, 62 instances of these backdoored consoles have been identified globally.

Attack Chain

1. Attacker pushes a modified, backdoored image of the ARTEX console to Docker Hub namespaces.
2. Target user pulls and deploys the malicious Docker image, typically as a root-privileged container.
3. Attacker accesses the internet-facing ARTEX login portal.
4. Attacker provides the secret marker within the CAPTCHA field to the login handler.
5. The hidden verifyCaptcha() function executes arbitrary commands as root via sh -c.
6. Attacker gains persistence and full system control, using the host to pivot into production environments and steal credentials.

Impact

The vulnerability results in an unauthenticated root shell on every installation of the backdoored ARTEX instance. Once compromised, the instance provides attackers with access to stored findings, live credentials, captured sessions, and local network positioning, facilitating lateral movement into production systems and the potential theft of financial or digital assets.

Recommendation

• Identify and audit all running containers in your environment to ensure that no ARTEX instances are present.
• Restrict outbound network access for any security-testing or administrative consoles to prevent unauthorized communication.
• Enforce a strict policy against pulling or running container images from unverified or untrusted Docker Hub namespaces.
• Immediately decommission and purge any Docker containers identified as using the backdoored tomicdd/artex or congdonglinux/artex images.