AI-based cyber threat executing unauthorised fund transfers from banking firms: Cert-In

New Delhi, Amid incidents of unauthorised fund transfers from bank accounts, India's cybersecurity watchdog Cert-In has issued an advisory to banking and financial services institutions to remain vigilant at all levels, as the threat of such breaches remains unabated.

The Indian Computer Emergency Response Team (Cert-In) has named the incident "Crafty Falcon", which uses publicly available AI tools to execute complete attack chains autonomously at machine speed and generate and refine large numbers of tailored attack scripts in rapid succession.

Cert-In said that its fresh advisory is an update to its advisory issued on October 9 on "Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities."


Cert-In said that continued analysis of incidents reported by affected entities, including non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment aggregators, payment service providers and cryptocurrency exchanges or virtual digital asset service providers, has revealed a significant escalation of this campaign.

Computer Security Incident Response Team - Finance (CSIRT-Fin) under CERT-In has designated the threat actor responsible for this campaign as "CRAFTY FALCON": an AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs.

"The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation," the advisory issued on Wednesday said.

Cert-In said that entities that worked on remedies to resolve the incident have been deliberately re-targeted, including after incomplete remediation and attacks have been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.

"All BFSI entities are strongly advised to treat this campaign as an immediate and continuing threat," the advisory said. Cert-In said that the group or entity behind the attack is using multiple publicly available AI-driven offensive security tools against affected entities, including the "ARTEX" family of LLM-based, "PentAGI" autonomous multi-agent AI penetration testing system and the "Cairn" attack search engine, in addition to the "CyberStrikeAl" framework.

"These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses," the advisory said.

To prevent breach, Cert-In has advised entities to treat the campaign as active, maintain heightened 24x7 security monitoring, with increased staffing and lowered alert thresholds during holidays, weekends and other low-coverage windows besides implementing other remedial measures.