THE CRUNCH
India's Computer Emergency Response Team has warned the financial services industry of a "significant escalation" in attacks by an "AI-assisted financial threat actor" it has named CRAFTY FALCON. CERT-IN first detected the attacks in October, warning digital lending platforms, fintech firms, payment service providers and wallet operators that internet-facing applications, exposed APIs and privileged endpoints were being targeted. In an update published on Thursday, the agency said successful attacks were continuing, including against organisations that had already tried to clean up their systems. "The same entities have been deliberately re-targeted, including after incomplete remediation and attacks have been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response," CERT-IN warned.
The crew's method starts with internet-exposed test or development environments, where it picks up artefacts such as shared credentials, tokens or network paths that lead into production systems. Once inside, it rewrites victims' applications to make unauthorised API calls, activity that defences assume is legitimate because only genuine apps should be calling those APIs. CERT-IN says the group produces many "functionally identical variants refined in rapid succession", a pattern it considers consistent with AI-generated code, and quickly exploits newly discovered vulnerabilities.
The agency also links the crew to AI-enhanced tools including the ARTEX pen-testing tool, the Cairn attack search engine and the CyberStrikeAI framework, all associated with users who appear to speak Chinese. To test whether an attack works, CRAFTY FALCON makes tiny payments of about $0.01 before moving to larger transfers. Against cryptocurrency exchanges and virtual asset service providers, it steals wallet keys and empties wallets.
CERT-IN's advice includes better logging, real-time anomaly monitoring and alerting, keeping test environments off the internet, and restricting access to cloud resources, which the attackers like to use to run their operations. It describes the attacks as "active and escalating" and deserving of round-the-clock monitoring. The advisory notes that only the fintech-style businesses above have reported attacks so far, but India's thousands of banks, many of them small operations with limited security resources, could offer a target-rich environment if the crew expands.