India Warns of AI-Driven Attacks by 'Crafty Falcon' Targeting Financial Sector

India's Computer Emergency Response Team (CERT-In) has issued a stark warning regarding a sophisticated new threat actor, dubbed 'Crafty Falcon,' which is employing advanced AI and agentic AI tools to target financial and cryptocurrency businesses. The advisory highlights the increasing use of artificial intelligence in cyber-attacks, with the group specifically focusing on non-banking financial companies, digital lending platforms, fintech firms, payment aggregators, payment service providers, and cryptocurrency exchanges.

CERT-In noted that some of these organizations had previously received a restricted advisory in early October about attackers exploiting application programmable interfaces (APIs) for unauthorized fund transfers. Despite initial remediation efforts, these entities were targeted again, indicating incomplete security measures.

Crafty Falcon's attack lifecycle begins with gaining initial access through internet-exposed non-production environments, such as user acceptance testing (UAT) and staging environments. The threat actor then moves into production systems by exploiting shared credentials, authentication tokens, or network paths between these environments. They meticulously reverse-engineer application codebases to develop tailored exploits, bypassing security controls by using modified application packages to initiate unauthorized API calls.

Further evasion tactics include bypassing IP allow-listing restrictions by routing traffic through whitelisted third-party fetcher IP pools, such as content-acceleration services. This allows malicious traffic to originate from IP addresses already trusted by the victim organization. The group also targets cloud infrastructure, abusing services like AWS Systems Manager and Lambda to execute commands and deploy malicious files, blending their activities with legitimate cloud operations.

Before executing large-value transfers, Crafty Falcon performs micro-value test transactions, often as low as Rs. 1, to confirm the feasibility of unauthorized fund flows. They exploit or abuse merchant settlement APIs belonging to payment aggregators to siphon funds. For cryptocurrency exchanges and virtual digital asset service providers, the actor targets wallet keys to steal funds directly.

CERT-In observed Crafty Falcon exploiting newly published vulnerabilities, including file-upload and deserialization exploit chains, to deploy web shells in PHP and Node.js applications. A key characteristic is the rapid creation and refinement of custom, tailored scripts, a pattern consistent with AI-generated code and iterative AI-assisted development. The use of AI penetration testing tools such as ARTEX (based on PetAGI), CyberStrikeAI, and the attack search engine Cairn allows for autonomous attack execution at machine speed and rapid adaptation of payloads.

While these AI tools are publicly available, their deployment in malicious campaigns has often been linked to China-based actors. CERT-In has provided a comprehensive list of mitigation recommendations, emphasizing heightened 24/7 security monitoring, centralized cloud audit log monitoring, strict access controls for cloud management services, and robust separation of non-production and production environments. Organizations are also advised to treat client applications as untrusted, enforce server-side transaction validation, and implement file-integrity monitoring to detect web shells.