CERT-In warns Indian fintechs of escalating AI-assisted attacks
India’s Computer Emergency Response Team (CERT-In) has warned financial services organizations that attacks attributed to a group it calls CRAFTY FALCON remain active and are escalating. The campaign targets digital lending platforms, fintech companies, payment service providers and wallet operators, with attackers seeking routes into payment systems and, in some cases, cryptocurrency wallets.
CERT-In first detected the activity in October and has since reported further successful incidents. Its latest advisory says some organizations were attacked again after attempting to address earlier compromises. The attackers have also timed operations for weekends, holidays and other periods when monitoring may be reduced, potentially delaying detection and response.
Exposed environments can provide a path to production
The group is reported to search for internet-accessible applications, APIs and privileged endpoints. It has shown interest in exposed testing and development environments, where shared credentials, access tokens or network paths may offer a route toward production systems. This makes the separation and protection of non-production infrastructure a relevant part of financial organizations’ defenses.
After gaining access, CRAFTY FALCON has reportedly modified victims’ applications to make unauthorized API calls. That approach can complicate detection when controls assume that requests from an approved application are legitimate. A trusted application identity may not, by itself, establish that the application’s behavior or transactions are authorized.
CERT-In says the attackers rapidly produce multiple functionally similar variants, refining them in succession. The agency describes this pattern as consistent with AI-generated code and iterative AI-assisted development. The group also reportedly moves quickly to exploit newly discovered vulnerabilities, changing its methods as weaknesses become available.
CERT-In identified ARTEX, a penetration-testing tool; Cairn, an attack search engine; and the CyberStrikeAI framework among tools used in the campaign. The advisory notes that these tools have been linked to users who appear to speak Chinese. That association does not, on its own, establish the group’s identity or location.
Payment tests can precede larger transfers
In payment-focused activity, the attackers reportedly begin with very small transfers of about $0.01 to check whether a transaction path works. If the test succeeds, they may attempt larger payments. For cryptocurrency exchanges and virtual digital asset service providers, CERT-In says the group has sought wallet keys and emptied cryptocurrency wallets.
These reported behaviors put transaction monitoring and application-level controls in focus. Financial organizations should assess whether alerts identify unusual API activity and suspicious payment patterns, including low-value transactions that could serve as tests. Organizations should also review whether their monitoring can distinguish expected application behavior from requests made after an application has been altered.
CERT-In calls for continuous monitoring
The agency recommends improving event logging, monitoring for anomalies in real time and generating alerts. It also advises organizations to keep testing environments off the public internet and restrict access to cloud resources, which the group reportedly uses to conduct attacks. CERT-In characterizes the activity as active and escalating and calls for 24-hour monitoring.
For organizations that have already responded to an incident, the reported repeat targeting is a reason to validate remediation rather than treating an initial cleanup as conclusive. Teams can review access to exposed development systems, credentials and tokens, API permissions, and the integrity of applications that interact with payment services. These measures align with the attack paths CERT-In described; the advisory does not establish that every organization has experienced each technique.
The advisory refers to activity affecting entities across banking, financial services and insurance, while its named reported victim categories include digital lenders, fintechs, payment providers and wallet operators. The warning therefore applies to a broad financial-services audience, but the available details do not identify individual victims or quantify the number of incidents.
