CERT-In Warns of Crafty Falcon Attacks on Indian Financial Firms
India's cybersecurity agency has warned financial institutions about an escalating campaign using artificial intelligence to automate cyberattacks and exploit payment infrastructure. The Indian Computer Emergency Response Team (CERT-In) has identified the threat actor behind the activity as Crafty Falcon, describing the campaign as an active and continuing threat.
The Crafty Falcon attacks have targeted non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators and cryptocurrency exchanges. According to CERT-In's November 4 advisory, attackers are using publicly available AI-driven security tools to identify weaknesses, develop tailored exploits and initiate unauthorised transactions through financial institutions' own systems.
The warning highlights how AI-assisted cybercrime is moving beyond conventional phishing and malware campaigns. Attackers are increasingly using automation to conduct multiple stages of an intrusion with limited manual intervention.
Crafty Falcon Attacks Exploit Financial APIs
A major concern is the attackers' use of payment and disbursement application programming interfaces (APIs). These interfaces allow banks, lenders and financial technology companies to exchange information and process transactions.
CERT-In said Crafty Falcon operates by identifying weaknesses in these systems and invoking the victims' own payment infrastructure to move money. In some incidents, attackers reportedly used small test transactions to check whether unauthorised fund transfers would succeed before attempting larger transactions.
The agency identified four AI-driven offensive security tools associated with the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI. These tools can automate reconnaissance, generate attack scripts and adapt their techniques based on how targeted systems respond.
The attackers have also exploited internet-facing testing and staging environments. They reportedly used shared credentials, access tokens and network connections to move from non-production systems into live environments. Cloud management services were also targeted to execute commands and deploy malicious files.
CERT-In Warns of Repeated Attacks During Weekends and Holidays
The campaign has another concerning characteristic: attackers are deliberately choosing periods when security teams may have fewer staff monitoring their systems.
CERT-In said Crafty Falcon attacks have been timed around weekends, holidays and other low-monitoring periods to delay detection and response. Some financial organisations that had already attempted to fix earlier vulnerabilities were targeted again after incomplete remediation.
The advisory also describes attacks involving newly disclosed software vulnerabilities, compromised merchant settlement APIs and cryptocurrency wallet keys. In some cases, attackers reportedly drained funds from cryptocurrency wallets after obtaining access to sensitive credentials.
CERT-In has urged financial institutions to strengthen continuous monitoring, review cloud access permissions and introduce additional transaction-level safeguards. It has also recommended detecting suspicious small-value transactions, unusual API activity and unauthorised changes to cloud services.
Possible China Links Remain Unconfirmed
The campaign has attracted additional attention because of the tools identified by CERT-In. Security researchers have linked at least two of them to China. ARTEX, in particular, has previously been associated with attacks against South Korean financial institutions.
Cybersecurity firm CrowdStrike has reported the use of ARTEX in attacks targeting South Korean banks. Its findings also connected the tool to a broader espionage campaign affecting more than 200 organisations across at least 14 countries.
However, the geographical links associated with some tools do not establish who is operating Crafty Falcon. CERT-In has not identified the individuals or organisation behind the campaign, confirmed where the operators are based or attributed the attacks to any government.
The agency has also not named the financial institutions affected by Crafty Falcon or provided a confirmed estimate of losses directly connected to the campaign.
What the Warning Means for India's Financial Sector
The Crafty Falcon attacks expose a growing weakness in connected financial infrastructure. Banks, NBFCs and fintech companies increasingly depend on APIs, cloud services and automated payment systems. A weakness in one part of this network can create opportunities for unauthorised access elsewhere.
The warning also shows why organisations cannot rely solely on conventional security checks. Financial institutions need stronger authentication, restricted API permissions, continuous monitoring and transaction verification across connected systems.
CERT-In has advised affected organisations to treat the campaign as an immediate and continuing threat. Its latest advisory provides detailed recommendations for detecting suspicious activity, containing compromised systems and preventing repeated intrusions.
As AI tools make cyber operations faster and easier to automate, protecting India's financial infrastructure will require security measures that can respond at the same speed.
