Security · High impactFan score 48 · Tier B3 sources
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
The Hacker News · By info@thehackernews.com (The Hacker News) ·
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country. Describing the…
The Brief
- CERT-In says the AI-assisted threat actor Crafty Falcon is targeting banking, financial services and insurance organizations in India.
- A trojanized cwpsrv web server, the component behind Control Web Panel, is used to distribute the CWPdoor Linux backdoor.
- QiAnXin's XLab reports the backdoor executes commands sent via web requests without leaving logs, and a backdoored ARTEX is reported to expose 62 consoles to root access.
Why it matters
Servers running Control Web Panel may carry a backdoor that gives attackers command execution without leaving logs, so affected hosts can be compromised without obvious traces.
Who’s affected
- Admins running Control Web Panel (CWP) on Linux hosting servers
- Organizations in India's banking, financial services and insurance sectors targeted by Crafty Falcon
What to do
- Check Linux servers running Control Web Panel for a trojanized cwpsrv and the CWPdoor backdoor
- #security
- #malware
- #backdoor
- #linux
- #supply-chain
- #control-web-panel
Timeline
CERT-In discloses AI-assisted attacks by Crafty Falcon against BFSI organizations in India
CWPdoor Linux malware reported as distributed via trojanized cwpsrv
The Hacker News
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
BleepingComputer
Hackers backdoor Linux servers using trojanized CWP web server
The Hacker News
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
Full coverage · 3 sources
- 6h ago ↗
The Hacker News
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs - 20h ago ↗
BleepingComputer
Hackers backdoor Linux servers using trojanized CWP web server - 1d ago ↗
The Hacker News
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
