# CERT-In Uncovers AI-Driven Cyber Threats Compromising BFSI Sector

*Published November 6, 2026*
*Source: [https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html)*

## Executive Summary

CERT-In has identified AI-driven cyber attacks targeting the BFSI sector in India, primarily through the use of tools like ARTEX. These attacks exploit vulnerabilities to steal credentials and funds, necessitating robust security measures and oversight in AI system deployment.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/cert-in-uncovers-ai-driven-cyber-threats-compromising-bfsi-sector) or [see plans](https://www.sec-news.ai/pricing).*

## Article

The Indian Computer Emergency Response Team, CERT-In, has identified a sophisticated cyber threat targeting the banking, financial services, and insurance sectors in the country. The threat actor, known as Crafty Falcon, employs artificial intelligence-assisted tools such as ARTEX, PentAGI, Cairn, and CyberStrikeAI to execute rapid and autonomous attack chains. These tools have been used to target cryptocurrency exchanges and digital asset service providers, leading to significant financial losses in the form of stolen keys and funds. 

CERT-In reports that attackers are exploiting vulnerabilities in internet-facing applications, exposed APIs, and privileged endpoints to obtain sensitive credentials. This allows them to directly invoke fund-transfer APIs, effectively bypassing application-level controls. The attacks are designed to quickly move funds into attacker-controlled accounts, while also deleting logs and tampering with endpoint security tools to hinder detection and response efforts. 

The situation is further complicated by the compromise of cloud infrastructure, where attackers deploy malicious payloads and access publicly-available non-production environments. This enables them to obtain shared credentials and pivot to production systems. In response, CERT-In has issued guidelines for AI security auditing, emphasizing the need for governance, security, and human oversight in AI systems. 

The use of open-source penetration testing tools like ARTEX in these attacks has led its developer to remove the repository from GitHub. However, copies have reappeared, with a modified version on Docker Hub that allows unauthenticated root access. As of early November 2026, 62 ARTEX consoles have been identified with this backdoor, with significant numbers located in the U.S., Hong Kong, and China. The ongoing threat underscores the need for heightened awareness and stronger security measures in the BFSI sector.