India's CERT-In Warns of AI-Driven Attacks Moving Fast Against Financial Firms

The Indian Computer Emergency Response Team (CERT-In) has disclosed an active and ongoing campaign by a threat actor it tracks as Crafty Falcon. The group is targeting banking, financial services and insurance organisations in India, along with cryptocurrency exchanges and digital asset providers, where keys and funds have been stolen. CERT-In says the actor uses publicly available AI-driven offensive tools including ARTEX, PentAGI, Cairn and CyberStrikeAI.

According to the agency, these tools run complete attack chains on their own at machine speed, produce and refine many tailored attack scripts quickly, and adjust their payloads based on how targets respond. The supporting infrastructure also changes IP addresses within hours to days, which makes blocking harder.

CERT-In described related campaigns that exploit internet-facing applications, exposed APIs and privileged endpoints to steal payment gateway and partner-bank API credentials. Attackers then trigger fund transfers from inside the victim's own allow-listed infrastructure, which sidesteps application controls such as KYC, beneficiary verification and per-transaction limits. Funds are moved to mule accounts across multiple banks. The operators also delete logs and tamper with endpoint security tools, and they target cloud infrastructure and publicly accessible non-production environments to find shared credentials and pivot into production systems. This summary covers only the opening of the original report.