Evidence · DiggingBeagle record
BadByte investigation of a backdoored ARTEX Docker image
A Docker image impersonating an ARTEX continuation inserted a Go function named server.verifyCaptcha into the login path. Its server accepted a crafted pre-authentication login marker and invoked a shell command inside the container running as root. BadByte compared the binaries and found reachable backdoored consoles. Its November 5 revision records 7,946 pulls by November 3, 62 reachable backdoored panels during the November 2–4 scan and 46 still reachable on November 4; a pull is not a confirmed exploited victim. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
A Docker image impersonating an ARTEX continuation inserted a Go function named server.verifyCaptcha into the login path. Its server accepted a crafted pre-authentication login marker and invoked a shell command inside the container running as root. BadByte compared the binaries and found reachable backdoored consoles. Its November 5 revision records 7,946 pulls by November 3, 62 reachable backdoored panels during the November 2–4 scan and 46 still reachable on November 4; a pull is not a confirmed exploited victim. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsTrojanized ARTEX Docker image executed commands before login authentication: BadByte compared the binaries and found reachable backdoored consoles. Its November 5 revision records 7,946 pulls by November 3, 62 reachable backdoored panels during the November 2 to 4 scan and 46 still reachable on November 4; a pull is not a confirmed exploited victim.
Binary comparison; server.verifyCaptcha and /api/auth/login; Exposure and Docker Hub takedown
- supportsTrojanized ARTEX Docker image executed commands before login authentication: A Docker image impersonating an ARTEX continuation inserted a Go function named server.verifyCaptcha into the login path. Its server accepted a crafted pre-authentication login marker and invoked a shell command inside the container running as root.
Binary comparison; server.verifyCaptcha and /api/auth/login; Exposure and Docker Hub takedown
- supportsTrojanized ARTEX Docker image executed commands before login authentication: BadByte reports that Docker Hub removed the two identified malicious ARTEX image references on November 5, 2026. The takedown does not automatically remediate already pulled images or separately mirrored images.
November 5 update, Docker Hub takedown and exposure survey