CERT-In Warns Banks of Escalating ‘Crafty Falcon’ Cyberattacks Using AI Tools to Steal Funds

India’s cybersecurity watchdog, CERT-In (Indian Computer Emergency Response Team), has warned banks, non-banking financial companies (NBFCs) and fintech firms of escalating cyberattacks targeting financial systems and enabling unauthorised fund transfers.

In an advisory issued on Wednesday, the watchdog identified the campaign as ‘Crafty Falcon’, an AI-assisted cyber threat that uses publicly available tools to automate attacks and execute them at machine speed.

The attackers are using these tools to generate, customise and refine large volumes of attack scripts in quick succession, allowing them to target vulnerabilities across financial institutions.

The latest warning updates an earlier advisory issued on October 9, titled ‘Threat Actors Exploiting Payment and Disbursement APIs for Unauthorised Fund Transfers in BFSI Entities’.

Crafty Falcon attacks continue despite earlier warnings

Cert-In said its analysis of incidents reported by affected organisations had revealed a significant escalation in the campaign. Fresh attacks have continued even against financial institutions that had received earlier restricted advisories and taken remedial measures.

The watchdog said the Computer Security Incident Response Team-Finance (CSIRT-Fin) continued to receive reports of successful breaches, including from NBFCs and fintech companies.

Some organisations have been deliberately targeted again, particularly those that failed to address previously identified vulnerabilities fully.

Attackers have also timed operations to coincide with weekends, public holidays and other periods when security teams operate with reduced staffing. This has delayed the detection of suspicious activity and the response to breaches.

Which AI tools are attackers using?

Cert-In has identified several publicly available offensive security tools being used in the campaign. These include:

• ARTEX: A family of large language model-based tools used to generate and refine attack scripts.
• PentAGI: An autonomous, multi-agent AI penetration testing system capable of carrying out complex security operations.
• Cairn: An attack search engine used to identify potential routes into target systems.
• CyberStrikeAI: A framework designed to support automated cyber operations.

According to the advisory, these tools can execute entire attack chains with limited human intervention. They can also modify attack payloads in response to how targeted systems behave.

The automation allows attackers to conduct repeated, customised attempts at a pace that can overwhelm conventional security monitoring.

How are attackers breaching banks and fintech systems?

Cert-In has identified the following methods used by attackers:

- Exploiting testing environments: Targeting internet-facing testing and staging environments to access production systems through shared credentials, authentication tokens and network connections.

- Abusing cloud infrastructure: Misusing legitimate services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files while disguising activities as routine operations.

- Manipulating mobile applications: Reverse-engineering application code and using modified app packages to initiate unauthorised API calls.

- Bypassing IP-based security: Routing requests through whitelisted third-party services to bypass IP-based restrictions and access protected systems.

- Testing fraudulent transactions: Making micro-value transfers, sometimes as low as ₹1, to test unauthorised payment routes before attempting larger fund transfers.

- Exploiting payment aggregator APIs: Targeting merchant settlement APIs to move funds without authorisation.

- Exploiting software vulnerabilities: Taking advantage of newly disclosed file-upload and deserialisation weaknesses in PHP and Node.js applications.

- Targeting cryptocurrency platforms: Stealing wallet keys and siphoning funds from cryptocurrency exchanges and virtual digital asset service providers.

What Should Banks and Fintech Companies Do?

Cert-In has recommended the following security measures:

• Improve round-the-clock monitoring: Increase security staffing and lower alert thresholds during weekends and holidays.
• Strengthen cloud security: Monitor cloud audit logs in real time and restrict access to cloud management services and serverless functions.
• Separate testing from production: Isolate testing environments and avoid sharing credentials or API keys with production systems.
• Secure payment APIs: Introduce server-side transaction validation, API request signing and application attestation.
• Patch vulnerabilities faster: Fix security flaws in internet-facing applications, particularly PHP and Node.js vulnerabilities.
• Strengthen access controls: Replace IP-based restrictions with identity-based security measures.
• Monitor suspicious transactions: Flag small-value transfers to new beneficiaries followed by high-value transactions.
• Protect cryptocurrency assets: Secure wallet keys through hardware security modules or cold custody, require multi-signature withdrawal approvals and monitor unusual transactions.

Why the warning matters for banking customers

The Crafty Falcon campaign highlights the risks posed by weaknesses in the systems that connect banking applications, payment gateways, cloud infrastructure and financial service providers.

The use of small-value transactions to test unauthorised transfers is particularly significant. A seemingly insignificant payment could form part of a larger attempt to exploit a compromised account or payment API.

The advisory does not establish that every unauthorised bank transfer is linked to Crafty Falcon. However, the continued attacks on NBFCs and fintech companies suggest that previously identified weaknesses remain a concern across the financial sector.

For customers, the immediate risk is the potential misuse of compromised financial infrastructure to move money without authorisation.

What happens if a financial institution detects a breach?

Cert-In has advised organisations that suspect a breach to isolate compromised systems immediately and preserve forensic evidence, including system and security logs.

They should also rotate affected credentials, investigate the extent of the compromise and report the incident to Cert-In or CSIRT-Fin.

The watchdog has called on organisations to restrict unauthorised AI-driven security and attack tools on corporate systems and monitor the use of large language model APIs.

It has also recommended adopting zero-trust security principles, micro-segmentation and identity-based access controls to limit unauthorised movement across networks.

The advisory makes clear that earlier remediation alone may not be enough. Financial institutions must continue monitoring their systems, reassess exposed services and account for attacks that exploit periods when security oversight is reduced.