CRAFTY FALCON Hits Indian Fintechs

The attackers wait until the building empties out. India's CERT-IN says an AI-assisted financial threat actor it has named CRAFTY FALCON has been timing intrusions against digital lenders, payment processors, and wallet operators to coincide with weekends, holidays, and other stretches when monitoring is thin. The component of the story that should worry defenders most is not the schedule, though. It is what the agency says happened after victims tried to clean up.

In an update published Thursday, the CERT said it continues to receive reports of successful attacks, including against organizations that had attempted remediation after earlier incidents. The advisory describes the attacks as active and escalating, and calls for round-the-clock monitoring.

Holiday and weekend timing

CERT-IN first detected the campaign in October and issued an advisory to digital lending platforms, fintech entities, payment service providers, and wallet operators. The initial warning described attackers going after internet-facing applications, exposed APIs, and privileged endpoints, and attempting to use payment APIs to steal money once inside.

The Thursday update added detail on scheduling. The agency said attacks were deliberately arranged to land during holidays, weekends, and other low-monitoring windows in order to delay detection and response. The same organizations, it said, were deliberately hit again — including cases where remediation had been left incomplete.

That pattern puts a specific kind of pressure on security teams at small and mid-sized financial firms, where on-call coverage may be thinner outside business hours and where a partial fix can leave the same entry point open. According to the CERT, the re-targeting was not incidental.

The naming and the toolset

CERT-IN decided the attackers needed a name and chose “CRAFTY FALCON.” It also published details of the tooling it attributes to the crew: the ARTEX penetration-testing tool, the Cairn attack search engine, and the CyberStrikeAI framework. The CERT said all three have been linked to users who appear to speak Chinese.

Naming a threat actor is not routine for the agency, and attaching a specific toolset gives defenders something to hunt for in logs and endpoint telemetry. The advisory does not, in the text reviewed here, specify how the tools are used in each stage of an intrusion.

Where they get in

The entry path described by CERT-IN starts with internet-exposed environments used for testing or development. In those environments, the crew looks for artefacts such as shared credentials, tokens, or network paths that can be used to move into production systems.

Test and development infrastructure is often treated as lower-risk than production, which is why credentials and tokens can sit there with weaker controls. For CRAFTY FALCON, according to the CERT, that material is the bridge into the systems that actually process payments.

The agency's guidance reflects this: it urged organizations to keep test environments off the internet and to restrict access to cloud resources, noting that the crew favors cloud infrastructure to run its attacks.

Rewriting the application

Once inside, the crew does not simply fire off requests from an external machine. CERT-IN says it re-writes victims' applications so they perform unauthorized API calls. Because defenders' systems assume only legitimate applications would call those APIs, activity generated by the modified apps is not flagged as an attack.

That approach exploits a common assumption in application security: that the software making a call is trustworthy because it is the software the organization deployed. If the application itself has been altered, that assumption stops holding.

The CERT also describes the output of this process as many “functionally identical variants refined in rapid succession; a pattern consistent with AI-generated code and iterative AI-assisted development.” In other words, the same malicious capability shows up in slightly different forms, quickly, which complicates signature-based detection.

The crew also moves fast on newly disclosed vulnerabilities, according to the advisory, exploiting them to keep attacks current.

One-cent tests, then the real theft

CERT-IN's account of the money-moving phase is unusually granular. The crew makes tiny payments of about $0.01 to test whether its attacks work. If those transfers go through, it moves on to larger payments.

When the target is a cryptocurrency exchange or a virtual digital asset service provider, the CERT says the crew steals wallet keys and empties cryptocurrency wallets. The small-value probe appears designed to confirm that a compromised application can actually move funds before committing to a bigger transfer.

For payment service providers and wallet operators, that means the difference between a failed intrusion and a successful one may be visible in transaction logs as a series of near-zero-value transfers.

What the CERT is telling defenders

The advisory's recommendations lean heavily on visibility and attack surface reduction. CERT-IN urged Indian businesses to improve their ability to log events, monitor for anomalies in real time, and send alerts. It also called for keeping test environments off the internet and restricting access to cloud resources.

The CERT also warns that the attacks are “active and escalating” and therefore worthy of 24x7 monitoring. For organizations that scaled back overnight coverage, that advice is direct: the attackers are reportedly counting on the hours when nobody is watching.

“The same entities have been deliberately re-targeted, including after incomplete remediation and attacks have been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response,” the CERT warned.

— CERT-IN, in its Thursday update to the October advisory

Who is in the frame

The CERT's advisory mentions attacks on entities across banking, financial services, and insurance, but only names the kinds of businesses mentioned above — digital lending platforms, fintech entities, payment service providers, and wallet operators — as having reported attacks.

That distinction matters in a market as large as India's. The country is home to thousands of banks, many of them small operations that sometimes lack basic infosec protections, which gives CRAFTY FALCON a broad set of potential targets should it widen its activity.

Why this matters beyond one advisory

The CRAFTY FALCON advisory describes a playbook built around defenders' blind spots: the weekend, the holiday, the test server left facing the internet, the application trusted because it is the application. Each of those is a normal operational compromise made for convenience or cost, and each, per CERT-IN, has been used against Indian financial firms.

The re-targeting detail is the one that may matter most for anyone running remediation right now. If an organization cleans up after an incident but leaves part of the fix undone, this account suggests the same crew may come back for the remainder. That makes verification of remediation — not just its completion — a live operational question for fintech security teams.

The AI angle deserves similar caution. CERT-IN attributes the rapid succession of functionally identical variants to AI-assisted development, and describes the crew as AI-assisted. Whether or not that characterization holds up under outside scrutiny, the practical consequence for defenders is the same: detection tuned to a single known pattern may not last long.

For payment providers and wallet operators in India, the advice amounts to a to-do list that is unglamorous and specific: get test environments off the internet, tighten cloud access, watch for tiny test transactions, and staff the hours when the attackers are reportedly most active.