{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/artex-backdoored-docker-builds/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ARTEX (Backdoored Docker builds)"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","backdoor","container","credential-access","artex","linux"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCERT-In reported that backdoored versions of the ARTEX penetration testing console, distributed via Docker Hub, are being used to grant attackers unauthenticated root shell access. The malicious routine injects a hidden \u003ccode\u003everifyCaptcha()\u003c/code\u003e function into the login handler, which executes input via \u003ccode\u003esh -c\u003c/code\u003e as root if a specific secret marker is detected in the CAPTCHA field. As of November 4, 2026, 62 instances of these backdoored consoles have been identified globally.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker pushes a modified, backdoored image of the ARTEX console to Docker Hub namespaces.\u003c/li\u003e\n\u003cli\u003eTarget user pulls and deploys the malicious Docker image, typically as a root-privileged container.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the internet-facing ARTEX login portal.\u003c/li\u003e\n\u003cli\u003eAttacker provides the secret marker within the CAPTCHA field to the login handler.\u003c/li\u003e\n\u003cli\u003eThe hidden \u003ccode\u003everifyCaptcha()\u003c/code\u003e function executes arbitrary commands as root via \u003ccode\u003esh -c\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker gains persistence and full system control, using the host to pivot into production environments and steal credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in an unauthenticated root shell on every installation of the backdoored ARTEX instance. Once compromised, the instance provides attackers with access to stored findings, live credentials, captured sessions, and local network positioning, facilitating lateral movement into production systems and the potential theft of financial or digital assets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and audit all running containers in your environment to ensure that no ARTEX instances are present.\u003c/li\u003e\n\u003cli\u003eRestrict outbound network access for any security-testing or administrative consoles to prevent unauthorized communication.\u003c/li\u003e\n\u003cli\u003eEnforce a strict policy against pulling or running container images from unverified or untrusted Docker Hub namespaces.\u003c/li\u003e\n\u003cli\u003eImmediately decommission and purge any Docker containers identified as using the backdoored \u003ccode\u003etomicdd/artex\u003c/code\u003e or \u003ccode\u003econgdonglinux/artex\u003c/code\u003e images.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T10:04:43Z","date_published":"2026-11-05T10:04:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-artex-backdoor/","summary":"Attackers are distributing backdoored Docker images of the ARTEX offensive security tool that grant unauthenticated root access via a hidden command injection vulnerability in the login handler.","title":"ARTEX Penetration Testing Tool: Backdoored Docker Images","url":"https://feed.craftedsignal.io/briefs/2026-11-artex-backdoor/"}],"language":"en","title":"CraftedSignal Threat Feed - ARTEX (Backdoored Docker Builds)","version":"https://jsonfeed.org/version/1.1"}