# CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

Source: [The Hacker News](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html) · 2026-11-05 · Security
Page: https://themorning.dev/story/cert-in-flags-ai-driven-attacks-as-backdoored-artex-exposes-62-consoles-to-root-4f9bb7c1ff8e1d8d
Kind: security · Impact: high

## In brief

- Datadog Security Labs reports in-the-wild activity from ARTEX, an AI-native penetration framework, targeting AWS environments.
- The campaign includes CloudWatch log hunting using compromised access keys.
- Attackers also abuse public Amazon Cognito user pools.

## Why it matters

Developers running AWS workloads should assume automated, agent-driven attacks can search logs for leaked credentials and probe identity services such as Cognito.

## Timeline

- 2026-11-09: Datadog Security Labs publishes analysis of ARTEX activity against AWS environments

## Coverage

- [FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’](https://therecord.media/artex-ai-tool-fbi-flash-alert) — The Record from Recorded Future News, 2026-11-13
- [ARTEX and beyond: AI-enabled penetration testing platforms](https://blog.talosintelligence.com/artex-and-beyond/) — Cisco Talos Blog, 2026-11-13
- [Adapting to AI penetration testing orchestrators: The Modern Security Model](https://blog.cloudflare.com/adapting-to-ai-penetration-testing-orchestrators/) — Cloudflare Blog, 2026-11-13
- [ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.](https://www.stepsecurity.io/blog/artex-ai-pentesting-tool-attackers-leaked-secrets) — Step Security Blog, 2026-11-13
- [On the hunt for ARTEX: understanding agentic attacks in AWS environments](https://securitylabs.datadoghq.com/articles/artex-agentic-attacks-aws-environments/) — Datadog Security Labs, 2026-11-09
- [Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches](https://securityaffairs.com/202607/ai/inside-artex-ai-hacking-tools-exposed-servers-and-south-korean-bank-breaches.html) — Security Affairs, 2026-11-07
- [ARTEX abuse expands as cybercriminals target financial sector](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/) — Microsoft Security Blog, 2026-11-07
- [Hundreds of Artex AI hacking tools found publicly exposed to the web](https://techcrunch.com/2026/11/06/hundreds-of-artex-ai-hacking-tools-found-publicly-exposed-to-the-web/) — AI News & Artificial Intelligence | TechCrunch, 2026-11-06
- [Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs](https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html) — The Hacker News, 2026-11-06
- [Hackers backdoor Linux servers using trojanized CWP web server](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/) — BleepingComputer, 2026-11-05
- [CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html) — The Hacker News, 2026-11-05

Tags: security, aws, ai-agents, cloud, penetration-testing

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev