The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.
Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools like ARTEX, PentAGI, Cairn, and CyberStrikeAI.
"These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession, and adapt their payloads based on target responses," CERT-In said. "The supporting attack infrastructure rotates IP addresses within hours to days."
The agency said the attacks have also targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of keys and funds.
The update follows an October 2026 alert issued by CERT-In, which warned of multiple cyber attack campaigns targeting non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment service providers, and cryptocurrency wallet operators.
Threat actors have been observed exploiting internet-facing applications and exposed APIs and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, and then invoke fund-transfer APIs directly from within the entities' own allow-listed infrastructure.
Some of the other notable initial access vectors are listed below -
This approach, CERT-In added, defeats application-level controls such as loan creation, KYC, sanction, beneficiary verification, balance sufficiency, and per-transaction limits.
The rapidly executed fraudulent transactions are designed to move funds to attacker-controlled mule accounts across multiple banks. In addition, the attacks involve the operators taking steps to delete logs and tamper with endpoint security tools in an attempt to complicate detection and incident response efforts.
Source link
