The CRAFTY FALCON campaign targets financial firms’ own infrastructure, while crypto service providers face stolen wallet keys and siphoned funds.

India’s Computer Emergency Response Team, CERT-In, has issued a critical warning about escalating AI-assisted attacks on banking, financial services and insurance entities, including repeat targeting after incomplete remediation. Its Nov. 4 CRAFTY FALCON advisory describes an ongoing campaign that abuses financial institutions’ own cloud services and payment interfaces to move funds.

Cryptocurrency exchanges and virtual digital asset service providers are among the affected categories. CERT-In reports stolen wallet keys and funds siphoned from cryptocurrency wallets, placing crypto custody within a broader warning that also covers non-bank financial companies, digital lending platforms, fintech firms and payment providers. The public advisory does not name an affected exchange or quantify the losses.

The notice updates CERT-In’s Oct. 9 advisory on unauthorized fund transfers through payment and disbursement APIs, the interfaces applications use to request those transactions. @IndianCERT announced the new advisory on Nov. 4. The agency says its finance response team, CSIRT-Fin, has designated the actor behind the campaign CRAFTY FALCON.

CERT-In says it continues to receive reports of successful attacks involving NBFCs and fintech entities that had received earlier restricted warnings and undertaken remediation. It specifically identifies re-targeting after incomplete remediation, with attacks timed for holidays, weekends and other periods of reduced monitoring.

CERT-In describes several routes through institutions’ infrastructure. Internet-facing testing and staging environments have provided entry points, followed by access to production systems through shared credentials, tokens or network connections.

Source link