A security vulnerability in a compromised build of the AI penetration testing software ARTEX gives unauthorized users full administrative privileges over the systems hosting the tool. Security analysts located 62 internet-facing consoles running a malicious Docker image that embeds a root shell in its login handler, allowing attackers to bypass authentication and obtain root access.
The discovery follows earlier warnings that the framework’s open-source repository on GitHub contained a backdoor. Microsoft and CrowdStrike have linked ARTEX to Chinese state-aligned hacking groups Storm-0940 and Vapor Panda, which used the AI-driven software to automate attacks on hundreds of organizations globally, including 19 in the U.S. operating in the nuclear, pharmaceutical, and defense sectors.
