The Morning Dev

Only the news worth knowing

‹
 
B50/100

Supply-chain attack · high

Hundreds of exposed ARTEX penetration testing servers linked to backdoored ARTEX/CWP server images campaign

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Exposed ARTEX servers and CWP installations running trojanized cwpsrv

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Remote, no login · Full takeover · Supply chain

What to do

  1. Check whether ARTEX consoles are reachable from the internet and restrict access.
  2. Verify that ARTEX Docker images match trusted sources and were not backdoored.
  3. Audit CWP installations for a trojanized cwpsrv binary and the CWPdoor backdoor, as described in the reports.

The Brief

  • Hundreds of ARTEX penetration testing servers were found publicly exposed to the internet, according to TechCrunch.
  • A backdoored ARTEX/Docker image was reported by The Hacker News, with CERT-In flagging AI-assisted attacks by a threat actor tracked as Crafty Falcon against Indian BFSI organizations.
  • Microsoft reported that Storm-3358 began targeting financial sector organizations in October 2026 using the ARTEX agentic AI offensive tool.
  • Separately, a Linux backdoor named CWPdoor was found in a trojanized cwpsrv web server used by Control Web Panel, per BleepingComputer and The Hacker News.

Why it matters

Developers and sysadmins running ARTEX or Control Web Panel servers may have exposed consoles or backdoored binaries giving attackers command execution and root access.

The checklist behind the tier

Checklist · 5 of 10 yes
YesHits tech teamsJudgment: CWP and ARTEX servers are run and managed by ops, IT and security teams, so they fall in scope.
NoCore infrastructureJudgment: a single hosting panel and pentest tool, not shared core infrastructure like OpenSSH or the Linux kernel.
NoPopular toolJudgment: CWP is a niche free hosting panel and ARTEX a niche pentest tool, not mainstream developer tech.
YesExploited in the wildThe Hacker News: CERT-In says threat actor Crafty Falcon is actively targeting BFSI organizations; Microsoft reports Storm-3358 attacks.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept has been published.
YesRemote, no loginThe Hacker News (2026-11-06): backdoor executes commands sent via web requests; TechCrunch: servers allow anyone access.
YesFull takeoverThe Hacker News (2026-11-05) headline: backdoored ARTEX exposes 62 consoles to root access.
NoSecrets exposedNo source reports stolen credentials, keys, configs or customer data; sources only describe access and exposure.
YesSupply chainBleepingComputer: trojanized cwpsrv distributed as malware; The Hacker News: backdoored Docker image for ARTEX.
NoNo fix yetNo source states whether a patched version or vendor fix exists.

Timeline

  1. Storm-3358 began targeting financial sector organizations with ARTEX, per Microsoft (October 2026)

  2. CERT-In disclosed AI-assisted attacks by Crafty Falcon; BleepingComputer reported the CWPdoor trojanized cwpsrv

  3. The Hacker News

    CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

  4. BleepingComputer

    Hackers backdoor Linux servers using trojanized CWP web server

  5. QiAnXin XLab reported the CWP backdoor; TechCrunch reported hundreds of exposed ARTEX servers

  6. The Hacker News

    Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

  7. AI News & Artificial Intelligence | TechCrunch

    Hundreds of Artex AI hacking tools found publicly exposed to the web

  8. Microsoft Security Blog published ARTEX abuse expansion findings

  9. Microsoft Security Blog

    ARTEX abuse expands as cybercriminals target financial sector

Full coverage · 5 sources

First seen · 5 sources · Full story page · How tiers are decided