India flags AI-driven attacks on fintech

Financial firms in India are being hit not once but repeatedly, often after they believe a problem has been fixed. India's computer emergency response team has now put a name to the actor behind a wave of intrusions against non-banking financial companies, and says the toolkit includes AI and agentic AI penetration-testing software that automates much of the work.

The advisory, published on November 4, describes a threat actor it calls Crafty Falcon and lays out a lifecycle that runs from exposed test servers to unauthorized money movement. Some of the tools it lists have appeared in earlier campaigns attributed to Chinese hacking groups, though the agency stops short of naming an origin for this actor.

A warning that didn't stick

According to a new security advisory from the Indian Computer Emergency Response Team (CERT-In), the affected organizations include digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges.

Many of them had already been told to tighten up. In early October, a restricted-distribution advisory circulated to these companies warned that attackers were abusing application programming interfaces (APIs) normally used for payment and disbursement transactions in order to make unauthorized transfers.

The firms did remediation work. Then they were attacked again. CERT-In attributed this to "incomplete remediation" on their part. The repeat intrusions suggest that patching one exposed path left others open, or that the initial fixes did not address how the actor was getting in.

Timing was not incidental. Attacks were typically observed during holiday periods, on weekends and in what the agency called "other low-monitoring windows" to delay detection and response — periods when staffing is thinner and alerts may sit longer before someone looks at them.

Starting from the staging server

Crafty Falcon is described as a previously undocumented threat actor that uses a range of AI and agentic AI penetration testing tools to breach victim systems. Its entry point is not usually the hardened production application. It is what sits beside it.

Initial access typically comes through internet-exposed non-production environments: user acceptance testing (UAT), staging and testing environments. These are the systems teams spin up to check code before it ships, and they are frequently reachable from the open internet while receiving far less scrutiny than production.

From there the actor pivots into production by exploiting shared credentials, authentication tokens or network paths that connect the two environments. Once inside, it reverse-engineers the organization's application codebases to build tailored exploits, then uses altered or modified application packages to fire unauthorized API calls. Those calls slip past controls that assume only the legitimate client application will ever talk to the API.

Borrowing trusted IP addresses

IP allow-listing is a common defense for payment APIs — only traffic from known addresses gets through. CERT-In describes a way around it. The actor routes traffic through whitelisted third-party fetcher IP pools, such as content-acceleration services and app-store review fetchers.

These are shared services that any internet user can instruct to fetch arbitrary URLs. By bouncing requests through them, the actor originates traffic from IP addresses the target organization already trusts, and the allow-list stops functioning as a filter.

Cloud infrastructure is another target. CERT-In points to compute, serverless and management services, and specifically to abuse of cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files. Commands run this way blend into what looks like ordinary cloud administration.

Small tests before big transfers

Before moving significant sums, the actor validates that the money can actually move. CERT-In says Crafty Falcon performs micro-value test transactions — such as a transaction of Rs. 1 — to confirm unauthorized fund flows are possible.

When the path is confirmed, the actor exploits or abuses merchant settlement APIs belonging to payment aggregators to move funds. Against cryptocurrency exchanges and virtual digital asset service providers, the objective shifts to wallet keys and drainage of cryptocurrency wallets.

The actor also moves fast on new bugs. CERT-In notes that Crafty Falcon exploits newly published vulnerabilities as soon as they become publicly available, including file-upload and deserialization exploit chains that lead to web shells deployed in PHP and Node.js applications.

Code that looks machine-written

Throughout its operations, the actor generates large numbers of custom, tailored scripts on the fly. Functionally identical variants are refined in rapid succession — a pattern CERT-In describes as consistent with AI-generated code and iterative AI-assisted development.

The agency and its finance branch, CERT-Fin, observed the use and combination of several AI-powered offensive security tools against affected entities:

• Penetration testing tool ARTEX, based on PentAGI, an autonomous, multi-agent framework that can be plugged to large language models (LLMs)
• Penetration testing framework CyberStrikeAI
• Attack search engine Cairn

"execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses"

— CERT-In, in its advisory

These tools are publicly available and could be used by many threat actors. CERT-In noted, however, that most previous malicious campaigns in which they were deployed were linked to China-based actors. The agency did not attribute Crafty Falcon itself to any country in the advisory.

What CERT-In wants defenders to do

The advisory includes a long list of recommended measures, and several of them map directly onto the techniques described above.

On monitoring, CERT-In calls for heightened 24/7 security coverage, increased staffing and lower alert thresholds during holidays, weekends and periods of reduced monitoring — the same windows the actor favors.

On cloud, it recommends centralizing real-time monitoring of cloud audit logs and alerting on high-risk events including remote command execution, serverless function code updates and the creation of roles, users or access keys. Cloud management and serverless execution should be restricted to approved principals and accounts, with instance metadata service protections, least-privilege roles, restrictions on wildcard egress and default-deny internet egress for serverless functions.

On the environment separation that gave the actor its foothold, the agency says UAT, staging and testing environments should be separated from production with no shared credentials, tokens, API keys, databases or direct network paths.

On applications, it recommends making deployment directories read-only for application runtime users and implementing file-integrity monitoring to detect web shells. Client applications and packages should be treated as untrusted, with server-side transaction validation, API request signing using nonces and timestamps, application attestation and certificate pinning enforced.

Rapid patching SLAs for internet-facing applications should prioritize file-upload and deserialization vulnerabilities in PHP and Node.js, with WAF virtual patching used as an interim measure.

On transactions, CERT-In advises extending real-time monitoring to catch small-value test transactions to new beneficiaries followed by high-value transfers. Those patterns should be treated as strong indicators of potentially unauthorized fund transfers, with such transactions held or reviewed.

For crypto operators, wallet keys should be stored in hardware security modules or cold custody.

On the AI tooling itself, the agency recommends prohibiting unauthorized security and attack tools, including publicly available AI-driven offensive frameworks, on corporate infrastructure. It also recommends monitoring and governing LLM API usage and keys, noting that LLM API traffic originating from servers or non-development hosts may indicate attack infrastructure or a planted operator console.

Detection tuning is on the list too: adjusting SIEM correlation to identify machine-speed, multi-technique attacks, parallel attack threads, adaptive payload changes and continuous activity outside business hours, with automated SOAR-based containment. CERT-In also recommends zero-trust principles, micro-segmentation, identity-based access controls for every user and service, and inspection of east-west traffic.

Where to report it

The agency asked organizations to report suspicious activity that could be related to Crafty Falcon to incident@cert-in.org.in with all relevant logs. It also directed them to contact the Indian Cybercrime Coordination Centre (I4C) and its Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS).

The reporting channel matters as much as the technical controls here. A restricted advisory went out in early October and firms still got hit, which suggests that either the guidance was not fully acted on or the actor had more than one way in.

Why the repeat hits matter

The most uncomfortable detail in the advisory is not the AI tooling. It is that organizations were warned, remediated, and then compromised again. For fintechs, payment aggregators and exchanges, that pattern suggests remediation efforts may have been scoped too narrowly — closing the specific hole named in a warning while leaving the shared credentials, tokens or network paths between test and production environments intact.

The micro-value testing described by CERT-In is also a practical signal that defenders can watch for now. A one-rupee transfer to a new beneficiary is a cheap way for an attacker to check whether a settlement API will do what they want. Organizations that monitor for that pattern, and hold such transactions pending review, could catch a campaign before the large transfer follows.

For businesses running cloud workloads, the abuse of management services such as AWS Systems Manager and Lambda is a reminder that legitimate administrative channels can carry illegitimate commands. Alerting on remote command execution and serverless code updates, rather than treating them as routine noise, is the mitigation the agency points to.

The AI angle adds a different kind of pressure. If attack chains can run autonomously at machine speed and payloads adapt to responses, the response window narrows. CERT-In's advice to tune SIEM correlation for machine-speed, multi-technique activity and to automate containment reflects that reality, at least as the agency sees it. Whether firms act on it this time is the open question.