India’s cybersecurity watchdog, Cert-In, has issued a critical advisory to the banking and financial services sector, warning of “Crafty Falcon,” an AI-assisted cyber threat actor exploiting payment APIs for unauthorised fund transfers at machine speed.
Key Points
- India’s cybersecurity watchdog, Cert-In, has issued an urgent advisory to the banking and financial services institutions (BFSI) regarding an ongoing AI-assisted cyber campaign named “Crafty Falcon.”
- “Crafty Falcon” is an AI-assisted financial threat actor utilising publicly available AI tools like ARTEX, PentAGI, and Cairn to execute autonomous attack chains at machine speed.
- The campaign targets payment and disbursement APIs for unauthorised fund transfers, with continued incidents reported by NBFCs, fintech entities, and other payment service providers.
- The threat is active and ongoing, with attacks timed to coincide with holidays and weekends; the advisory was issued on Wednesday, noting re-targeting of remediated entities.
- Cert-In strongly advises BFSI entities to maintain heightened 24×7 security monitoring, increase staffing during low-coverage windows, and treat this as an immediate and continuing threat.
Amid incidents of unauthorised fund transfers from bank accounts, India’s cybersecurity watchdog Cert-In has issued an advisory to banking and financial services institutions to remain vigilant at all levels, as the threat of such breaches remains unabated.
Understanding The ‘Crafty Falcon’ Threat
The Indian Computer Emergency Response Team (Cert-In) has named the incident “Crafty Falcon”, which uses publicly available AI tools to execute complete attack chains autonomously at machine speed and generate and refine large numbers of tailored attack scripts in rapid succession.
Cert-In said that its fresh advisory is an update to its advisory issued on October 9 on “Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities.”
Cert-In said that continued analysis of incidents reported by affected entities, including non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment aggregators, payment service providers and cryptocurrency exchanges or virtual digital asset service providers, has revealed a significant escalation of this campaign.
Computer Security Incident Response Team – Finance (CSIRT-Fin) under CERT-In has designated the threat actor responsible for this campaign as “CRAFTY FALCON”: an AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.
Ongoing Attacks And AI Tools Utilised
“The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation,” the advisory issued on Wednesday said.
Cert-In said that entities that worked on remedies to resolve the incident have been deliberately re-targeted, including after incomplete remediation and attacks have been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.
“All BFSI entities are strongly advised to treat this campaign as an immediate and continuing threat,” the advisory said. Cert-In said that the group or entity behind the attack is using multiple publicly available AI-driven offensive security tools against affected entities, including the “ARTEX” family of LLM-based, “PentAGI” autonomous multi-agent AI penetration testing system and the “Cairn” attack search engine, in addition to the “CyberStrikeAl” framework.
“These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses,” the advisory said.
Cert-In’s Recommendations For BFSI Security
To prevent breach, Cert-In has advised entities to treat the campaign as active, maintain heightened 24×7 security monitoring, with increased staffing and lowered alert thresholds during holidays, weekends and other low-coverage windows besides implementing other remedial measures.
Disclaimer: News content is sourced from the stated source. Headlines, summaries, section headers, and images are automatically generated or selected using AI/algorithms and may not always be fully accurate. Readers are advised to refer to the full article for complete context.
