NEW DELHI, Nov 5: India’s cybersecurity agency has issued a critical warning to financial institutions over an escalating campaign of artificial intelligence-assisted cyberattacks targeting banks, non-banking financial companies (NBFCs), digital lending platforms, fintech firms and cryptocurrency exchanges.
The Indian Computer Emergency Response Team (CERT-In) has identified the hacking campaign as “Crafty Falcon”, describing it as an AI-assisted financial threat that uses machine intelligence to identify vulnerable organisations, automate attacks and exploit existing payment infrastructure to carry out unauthorised financial transactions.
In an updated advisory issued on November 4, the agency said the campaign remained active and ongoing, with fresh incidents being reported by affected organisations. The warning represents an escalation of an earlier advisory issued on October 9 concerning attacks on payment and disbursement application programming interfaces (APIs) used by financial institutions.
According to CERT-In, the attackers are increasingly relying on publicly available artificial intelligence-powered offensive security tools to automate different stages of cyber intrusions. These tools can examine targeted systems, identify weaknesses, develop customised attack scripts and modify their techniques according to the responses received from the targeted infrastructure.
The agency identified four tools associated with the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI. These platforms have capabilities that allow attackers to conduct security reconnaissance, automate penetration-testing activities and execute multiple stages of an attack with limited manual intervention.
CERT-In said the attackers use these technologies to operate at machine speed, allowing them to examine potential targets and generate large numbers of customised attack scripts in a relatively short period.
The campaign is particularly concerning because attackers are not necessarily attempting to break into financial systems through conventional methods alone. Instead, they are exploiting the payment and disbursement mechanisms already used by financial organisations.
According to the advisory, the hackers invoke the targeted organisations’ own payment and disbursement APIs to facilitate unauthorised fund transfers. APIs are software interfaces that enable different applications and financial systems to communicate and exchange information.
These interfaces are widely used by banks, digital lending companies, payment aggregators and other financial service providers to process transactions, distribute loans and connect their platforms with banking infrastructure.
If access controls, authentication procedures or transaction-monitoring mechanisms are inadequate, compromised APIs can provide attackers with opportunities to manipulate legitimate financial processes.
The agency also highlighted a concerning pattern in the timing of the attacks. Several incidents have reportedly been scheduled around weekends, public holidays and other periods when organisations may have fewer employees monitoring their systems.
Such timing can delay the identification of suspicious transactions and give attackers additional opportunities to move funds before security teams respond.
Another significant finding is that some organisations that had previously received cybersecurity warnings and undertaken corrective measures were targeted again.
CERT-In said certain institutions had implemented incomplete remediation measures, allowing attackers to exploit weaknesses that remained unresolved. The repeated targeting indicates that simply addressing an identified vulnerability may not be sufficient unless organisations verify that the entire affected system has been secured.
The advisory also identified the use of ARTEX, a family of large language model-based tools, PentAGI, an autonomous multi-agent artificial intelligence penetration-testing system, and Cairn, an attack search engine, alongside the CyberStrikeAI framework.
The use of these technologies demonstrates how AI-assisted cyber operations are becoming increasingly automated. Instead of relying entirely on individuals to identify vulnerabilities and prepare malicious scripts, attackers can use automated systems to perform several interconnected activities.
The agency’s warning comes amid growing concerns over cybersecurity incidents affecting India’s financial services sector.
Recent incidents have highlighted weaknesses in the digital infrastructure connecting banks, lenders and fintech companies. Reuters reported that two Mumbai-based non-bank lenders suffered unauthorised transfers worth approximately USD 2 million through accounts linked to ICICI Bank in October. The transactions reportedly involved compromised APIs used for loan disbursement instructions.
The country’s largest lender, State Bank of India, also disclosed a leak involving 3,897 customer records on the dark web last month. Other financial institutions have reported suspicious account activity and possible customer-data exposure.
However, CERT-In has not established that these individual incidents were directly connected to the Crafty Falcon campaign. It has also not disclosed the identities of the organisations affected by the campaign or the total financial losses attributed to it.
CERT-In+1
The agency has advised financial institutions to treat the threat as an immediate cybersecurity priority and strengthen their monitoring and response mechanisms.
Among the recommended measures is the adoption of zero-trust security principles, under which access to systems and sensitive resources must be continuously verified rather than automatically trusted because a user or application is already inside an organisation’s network.
Financial institutions have also been advised to introduce network micro-segmentation, which separates different parts of their digital infrastructure to prevent attackers from moving freely between systems after gaining initial access.
Another recommendation involves deploying deception technologies, including honeypots, decoy administrative panels and canary credentials. These systems are designed to attract or detect suspicious activity and generate alerts when unauthorised users attempt to access protected resources.
CERT-In has further advised organisations to closely monitor web directories, temporary folders and staging environments for unusual bursts of newly created scripts or repeated versions of similar files. Such activity could indicate the use of automated attack tools.
Institutions have also been urged to strengthen identity-based access controls and inspect internal network traffic, including communications between systems that may already have been compromised.
In the event of suspicious activity, organisations should immediately isolate affected systems, preserve digital evidence, examine available security logs and change potentially compromised credentials.
The agency has asked affected entities to report incidents to CERT-In and its financial-sector response team, CSIRT-Fin, through the designated reporting channels. It has also advised institutions to coordinate with the Indian Cyber Crime Coordination Centre for reporting bulk fraudulent transactions.
The latest warning highlights the growing challenge faced by India’s rapidly expanding digital financial ecosystem. With online lending, instant payments, digital wallets and cryptocurrency platforms becoming increasingly interconnected, a weakness in one system can potentially expose several connected services.
Financial institutions are therefore being encouraged to move beyond traditional cybersecurity practices and invest in continuous threat monitoring, stronger authentication systems and regular testing of their digital infrastructure.
The increasing use of AI by cybercriminals also raises concerns about the speed at which vulnerabilities can be identified and exploited. While artificial intelligence offers financial institutions opportunities to improve fraud detection and automate security operations, the same capabilities can be misused to develop more sophisticated attacks.
CERT-In’s advisory underscores the importance of treating cybersecurity as an ongoing responsibility rather than a one-time exercise. Organisations must ensure that vulnerabilities are completely addressed, third-party connections are properly secured and suspicious transactions are detected before they result in significant financial losses.
As the Crafty Falcon campaign remains active, financial institutions have been urged to review their security arrangements without delay and ensure that their response teams are prepared to deal with automated cyber threats.