Security · High impactFan score 50 · Tier B5 sources

Hundreds of Artex AI hacking tools found publicly exposed to the web

TechCrunch · By Zack Whittaker · 20h ago

The Brief · written from 5 sources

Hundreds of ARTEX penetration testing servers were found publicly exposed to the internet, according to TechCrunch.
A backdoored ARTEX/Docker image was reported by The Hacker News, with CERT-In flagging AI-assisted attacks by a threat actor tracked as Crafty Falcon against Indian BFSI organizations.
Microsoft reported that Storm-3358 began targeting financial sector organizations in October 2026 using the ARTEX agentic AI offensive tool.
Separately, a Linux backdoor named CWPdoor was found in a trojanized cwpsrv web server used by Control Web Panel, per BleepingComputer and The Hacker News.

Why it matters

Developers and sysadmins running ARTEX or Control Web Panel servers may have exposed consoles or backdoored binaries giving attackers command execution and root access.

Who’s affected

Teams running ARTEX penetration testing servers
Operators of Control Web Panel (CWP) Linux hosting servers
Financial and BFSI organizations in India and elsewhere

What to do

Check whether ARTEX consoles are reachable from the internet and restrict access.
Verify that ARTEX Docker images match trusted sources and were not backdoored.
Audit CWP installations for a trojanized cwpsrv binary and the CWPdoor backdoor, as described in the reports.

Security researchers found hundreds of servers hosting the penetration testing tool Artex exposed to the internet, allowing anyone access to the hacking tool.

Read the full story at techcrunch.com ↗