---
url: "https://www.xcademia.com/news/cert-in-warns-of-crafty-falcon-ai-driven-attacks-target-india-s-banking-and-financial-sector"
title: "CERT-In Warns of CRAFTY FALCON: AI-Driven Attacks Target India's Banking and Financial Sector"
description: "CERT-In warns of CRAFTY FALCON, an AI-driven threat targeting Indian banks and fintech firms through payment API abuse and automated cyberattacks."
publishedAt: "2026-11-05T09:34:50.717+00:00"
updatedAt: "2026-11-06T01:33:10.466106+00:00"
type: news
category: cybersecurity
source_name: "Indian Computer Emergency Response Team "
source_url: "https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0058&pageid=PUBVLNOTES02"
tags:
  - "#CraftyFalcon"
  - "#CERTIn"
  - "#AICybersecurity"
  - "#CyberAttacks"
  - "#BFSISecurity"
  - "#PaymentAPISecurity"
  - "#FinancialCybersecurity"
  - "#ThreatIntelligence"
---

# CERT-In Warns of CRAFTY FALCON: AI-Driven Attacks Target India's Banking and Financial Sector

> India's CERT-In warns that an AI-assisted threat actor, CRAFTY FALCON, is targeting financial institutions through automated attacks, payment API abuse, cloud infrastructure compromise and unauthorised fund transfers.

Source: **Indian Computer Emergency Response Team ** · 5 November 2026

India's Computer Emergency Response Team (CERT-In) has issued a critical cybersecurity advisory warning of an escalating campaign of AI-driven attacks targeting banking, financial services and insurance (BFSI) organisations.

Published on 4 November 2026, Advisory CIAD-2026-0058 identifies the threat actor behind the campaign as **CRAFTY FALCON**, an AI-assisted financial threat actor that uses machine intelligence to identify targets, automate attack operations and exploit legitimate payment and disbursement APIs to initiate unauthorised fund transfers.

The advisory highlights continued attacks against non-banking financial companies (NBFCs), digital lending platforms, fintech organisations, payment aggregators, payment service providers and cryptocurrency exchanges.

CERT-In classifies the threat as Critical and confirms that the campaign remains active and ongoing. It also reports that organisations previously notified about the activity have been targeted again, including entities that had already implemented remediation measures.

The latest warning reflects a growing cybersecurity challenge for financial institutions: attackers are increasingly combining artificial intelligence, automated offensive security tools and weaknesses in legitimate business infrastructure to execute complex financial attacks.

## 
CRAFTY FALCON: An AI-Assisted Financial Threat Actor

CERT-In's Computer Security Incident Response Team - Finance (CSIRT-Fin) has designated the threat actor responsible for this campaign as CRAFTY FALCON.

According to the advisory, the actor uses publicly available AI-driven offensive security tools to automate reconnaissance, develop tailored attack scripts and execute multiple stages of an attack.

The identified tools include:

- **ARTEX:** A family of large language model (LLM)-based offensive security tools.
- **PentAGI:** An autonomous, multi-agent AI penetration testing system.
- **Cairn:** An attack search engine.
- **CyberStrikeAI:** An AI-driven offensive security framework.

CERT-In reports that these tools can execute complete attack chains autonomously, generate large numbers of customised scripts and refine their payloads based on target responses.

The supporting attack infrastructure also changes frequently, with IP addresses rotating within hours to days.

This creates additional challenges for conventional security monitoring approaches that depend heavily on fixed IP addresses and known indicators of compromise.

The agency has shared detailed infrastructure fingerprints and detection rules with affected BFSI organisations through restricted advisories.

![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793871075011-info1--155-.webp)

## 
How CRAFTY FALCON Conducts Its Attacks

CERT-In's investigation identifies several techniques used against financial organisations. These attacks target cloud infrastructure, application security, payment workflows and cryptocurrency environments.

### 
1. Cloud Infrastructure Abuse

The threat actor targets cloud environments, including compute resources, serverless services and management infrastructure.

The advisory specifically identifies the abuse of services such as AWS Systems Manager and AWS Lambda to execute commands and deploy malicious files.

By using legitimate cloud management channels, attackers can make malicious activity resemble authorised administrative operations.

This increases the importance of monitoring cloud audit logs and investigating unexpected management sessions, serverless function updates and changes to access permissions.

### 
2. Exploitation of Non-Production Environments

Internet-facing development, testing, staging and User Acceptance Testing (UAT) environments are also being used as initial entry points.

Once attackers gain access, they attempt to move into production environments by exploiting shared credentials, authentication tokens and network connections.

Organisations that reuse credentials or maintain direct network paths between testing and production systems increase the potential impact of an initial compromise.

CERT-In recommends isolating non-production environments and applying production-grade security controls to internet-facing testing infrastructure.

### 
3. Reverse Engineering of Applications and API Abuse

Another identified technique involves reverse-engineering application codebases to develop customised exploits.

Attackers subsequently use modified or repackaged application packages to initiate unauthorised API requests.

This approach challenges security models that assume requests originate exclusively from legitimate mobile or web applications.

CERT-In recommends treating client applications as untrusted and enforcing transaction validation on the server side.

It also recommends API request signing using nonces and timestamps, application attestation services and certificate pinning.

### 
4. Bypassing IP Allow-Listing Controls

The advisory identifies attempts to bypass IP-based access restrictions by routing requests through trusted third-party fetcher IP pools.

These include content-acceleration services and app-store review fetchers.

Because shared fetcher services may be induced to retrieve arbitrary URLs, allowing their IP addresses does not necessarily establish the identity or legitimacy of the original requester.

CERT-In recommends replacing reliance on shared IP allow-lists with identity-based security mechanisms, including mutual TLS, cryptographically signed requests and scoped API keys.

### 
5. Micro-Value Transactions Before Large Transfers

One particularly important financial attack pattern involves small test transactions.

Attackers reportedly initiate micro-value transactions, such as ₹1 transfers, to verify whether unauthorised payment flows are functioning correctly.

After validating the transaction path, they may proceed with larger-value transfers.

CERT-In identifies this behaviour as a strong precursor to unauthorised fund transfers.

Financial institutions are advised to monitor transactions involving new beneficiaries, particularly when small transfers are followed by unusually large payments.

### 
6. Payment Aggregator Settlement API Abuse

The advisory also identifies the exploitation or abuse of merchant settlement APIs operated by payment aggregators.

These interfaces are used to process merchant settlements and move funds.

CERT-In recommends enforcing server-side validation, maker-checker approvals and reconciliation for settlement instructions submitted through payment aggregator APIs.

### 
7. Exploitation of Newly Disclosed Application Vulnerabilities

CRAFTY FALCON has also been associated with the rapid exploitation of newly published vulnerabilities.

CERT-In specifically highlights file-upload and deserialization exploit chains that can lead to web shell deployment in PHP and Node.js applications.

The advisory emphasises the importance of rapid security patching for internet-facing applications.

Organisations are also advised to use Web Application Firewall (WAF) virtual patching as an interim measure when immediate remediation is not possible.

### 
8. Cryptocurrency Wallet Compromise

Cryptocurrency exchanges and virtual digital asset service providers are among the targeted organisations.

CERT-In reports incidents involving stolen wallet keys and funds being siphoned from cryptocurrency wallets.

The recommended protections include storing wallet keys in Hardware Security Modules (HSMs) or cold custody, requiring multi-signature withdrawal approvals and monitoring withdrawal activity for anomalies.

## The Role of AI in Accelerating Financial Cyberattacks

A significant aspect of the CRAFTY FALCON campaign is the use of AI-assisted automation throughout the attack lifecycle.

CERT-In reports that attackers generate large numbers of customised scripts and rapidly refine functionally similar variants.

The agency describes this activity as consistent with AI-generated code and iterative AI-assisted development.

The identified tools can also adapt payloads according to target responses and execute multiple attack techniques in parallel.

This changes the operational challenge for defenders.

Security teams cannot rely exclusively on conventional detection methods that identify isolated malicious files, known IP addresses or previously documented attack signatures.

Instead, organisations need to identify behavioural patterns across cloud infrastructure, applications, authentication systems and financial transactions.

![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793871143265-info2--156-.webp)

## 
CERT-In's Recommended Security Measures

CERT-In has provided extensive defensive recommendations for BFSI organisations. These measures address cloud security, application protection, transaction monitoring, identity management and incident response.

### 
1. Strengthen Cloud Infrastructure Security

Organisations should:

- Centralise and continuously monitor cloud audit logs.
- Restrict cloud management operations to approved identities and accounts.
- Monitor remote command execution and serverless function code changes.
- Enforce instance metadata service protections.
- Apply least-privilege permissions to cloud instances and functions.
- Deny unrestricted outbound network traffic.
- Configure serverless functions without internet egress by default.

### 
2. Separate Testing and Production Environments

Organisations should maintain strict separation between UAT, staging, testing and production environments.

They should avoid sharing credentials, API keys, authentication tokens, databases or direct network paths between these environments.

Access from non-production systems to production resources should generate security alerts and trigger investigation.

### 
3. Improve Application and API Security

CERT-In recommends:

- Enforcing server-side validation of transactions and business rules.
- Implementing API request signing with nonces and timestamps.
- Using application attestation and certificate pinning.
- Making application deployment directories read-only for runtime users.
- Deploying file-integrity monitoring to detect web shells.
- Prioritising patches for file-upload and deserialization vulnerabilities.
- Using WAF virtual patching as an interim defence.

### 
4. Strengthen Identity and Secret Management

Organisations should prohibit hardcoded credentials and tokens in source code and build pipelines.

Additional recommendations include:

- Automated secret scanning across repositories and CI/CD pipelines.
- Short-lived and least-privilege access tokens.
- Regular rotation of build and deployment credentials.
- Branch protection and commit signing.
- Mandatory code reviews for production deployment branches.
- Alerts for unusual token usage based on IP addresses, user agents and geographies.

### 
5. Improve Network Monitoring

CERT-In recommends implementing default-deny outbound network policies through approved proxies.

Organisations should also consider TLS inspection and alerts for self-signed certificates presented over non-standard ports.

Security teams should monitor unrestricted HTTPS traffic that could be used for command-and-control communication or data exfiltration.

### 
6. Strengthen Financial Transaction Controls

Financial organisations should implement real-time transaction monitoring capable of identifying suspicious payment patterns.

Recommended measures include:

- Detecting small-value test transactions to new beneficiaries.
- Reviewing subsequent high-value transfers.
- Implementing transaction velocity rules.
- Introducing cooling periods for newly added beneficiaries.
- Applying amount-band anomaly detection.
- Enforcing maker-checker approvals for merchant settlements.
- Reconciling settlement instructions through payment aggregator APIs.

### 
7. Secure Cryptocurrency Assets

Cryptocurrency exchanges and virtual asset service providers should strengthen wallet security through:

- Hardware Security Modules or cold custody.
- Multi-signature withdrawal approvals.
- Monitoring unusual withdrawal patterns.
- Immediate key rotation following suspected compromise.

### 
8. Govern AI Tools and Penetration Testing

CERT-In advises organisations to prohibit unauthorised installation or execution of offensive security tools on corporate infrastructure.

Security teams should monitor the download and execution of publicly available AI-driven attack frameworks.

The advisory also recommends monitoring LLM API usage and associated keys. LLM API traffic originating from servers or non-development systems may indicate an attack infrastructure or a planted operator console.

All penetration testing activities should require written approval, a clearly defined scope and an authorised testing window.

### 
9. Improve Detection and Incident Response

Organisations should tune Security Information and Event Management (SIEM) systems to identify:

- Multiple attack techniques operating in parallel.
- Rapidly changing attack payloads.
- Machine-speed attack sequences.
- Continuous activity outside business hours.
- Repeated creation of functionally similar scripts.
- Suspicious activity across multiple infrastructure components.

CERT-In also recommends Security Orchestration, Automation and Response (SOAR)-based containment and deception techniques such as honeypots, decoy administrative panels and canary credentials.

Organisations should adopt zero-trust security principles, micro-segmentation and identity-based access controls.

![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793871181611-info3--155-.webp)

## 
What Organisations Should Do If They Detect CRAFTY FALCON Activity

CERT-In advises organisations to treat the campaign as an active and continuing threat.

If suspicious activity is identified, the recommended response includes:

1. Isolate affected hosts and systems.
2. Preserve forensic evidence and relevant security logs.
3. Rotate compromised credentials and access tokens.
4. Perform complete eradication and forensic verification.
5. Continue periodic threat hunting to identify potential persistence.
6. Report the incident to CERT-In/CSIRT-Fin.

Affected organisations can report suspicious activity through:

**CERT-In / CSIRT-Fin:** [incident@cert-in.org.in](mailto:incident@cert-in.org.in)

For bulk fraudulent transaction reporting, CERT-In also directs entities to contact the Indian Cybercrime Coordination Centre (I4C) through the Cyber Fraud Mitigation Centre (CFCFRMS Portal).

The agency has shared a restricted version of the advisory with relevant BFSI entities. This version includes detailed indicators of compromise, infrastructure fingerprints and detection rules.

CERT-In further warns organisations not to rely exclusively on blocking known indicators because these can change while attacker techniques remain consistent.

![info-4](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1793871247663-info4--6-.webp)

## 
What This Means for the Financial Services Industry

The CRAFTY FALCON advisory highlights a broader industry shift towards AI-assisted cyber operations.

Financial institutions are increasingly exposed to attacks that combine automated reconnaissance, application exploitation, cloud management abuse and legitimate financial transaction interfaces.

For enterprises, this means security strategies must extend beyond perimeter protection and traditional malware detection.

Payment APIs, cloud management services, application deployment pipelines and financial approval workflows must all be treated as important parts of the security boundary.

The reported re-targeting of previously affected organisations also highlights the importance of complete remediation and continuous threat hunting rather than relying on one-time incident response activities.

**The central lesson is that legitimate infrastructure and business APIs can become attack pathways when identity controls, transaction validation and monitoring are insufficient.**

BFSI organisations should therefore prioritise continuous monitoring, strong identity verification, transaction-level controls and coordinated incident response.

## Original source

https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0058&pageid=PUBVLNOTES02

## Tags

`#CraftyFalcon` · `#CERTIn` · `#AICybersecurity` · `#CyberAttacks` · `#BFSISecurity` · `#PaymentAPISecurity` · `#FinancialCybersecurity` · `#ThreatIntelligence`

---

## About this content

This Markdown news article is the citation-grade twin of [CERT-In Warns of CRAFTY FALCON: AI-Driven Attacks Target India's Banking and Financial Sector](https://www.xcademia.com/news/cert-in-warns-of-crafty-falcon-ai-driven-attacks-target-india-s-banking-and-financial-sector). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://www.xcademia.com/news/cert-in-warns-of-crafty-falcon-ai-driven-attacks-target-india-s-banking-and-financial-sector
- Publisher: Xcademia, https://www.xcademia.com
- Catalogue index: https://www.xcademia.com/llms-full.txt