CERT-In Flags Chinese-Linked AI Tools in Hacking Campaign Against Financial Firms

Bengaluru/Mumbai: India's ‌cybersecurity agency named the hacking group behind a wave of AI-driven attacks on financial firms and identified its tools, at least two of them linked to China, adding India to a growing list of countries where such tools have been used against banks.

The group, which the Indian Computer Emergency Response Team (CERT-In) calls "Crafty Falcon," has breached non-bank lenders, fintech firms and cryptocurrency exchanges, according to an advisory issued on Wednesday.

CERT-In did not say who was behind the breaches or where the ⁠organisation operates.

The advisory came after a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, even as authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks.

CERT-In said the attackers use publicly available AI tools to automate break-ins "at machine speed," calling the threat "active and ongoing."

It named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China.

China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said.

It said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.

CERT-In did not name the affected companies or say how much money was stolen.

The agency did not say the attacks were state-sponsored and the ‌tools ⁠it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked to the South Korean attacks.

CERT-In, the Indian Cybercrime Coordination Centre and India's IT ministry did not immediately respond to requests for comment.

CERT-In said Crafty Falcon "surveys its targets with machine intelligence" and moves money by invoking victims' own payment and disbursement systems.

Attacks were timed around holidays, weekends and other ⁠low-monitoring periods to delay detection. Firms that had fixed flaws after earlier alerts were attacked again after incomplete remediations were made, it said.

Reuters previously reported, citing a police complaint, that last month two Mumbai-based non-bank lenders lost about $2 million in more than 700 unauthorised instant transfers from accounts of ⁠India's third-largest lender ICICI Bank on October 8 and 9.

The complaint said hackers compromised its application programming interfaces (APIs), the software links banks use to connect with non-bank lenders and fintech firms to send loan-disbursal instructions.

State Bank of India, the country's largest lender, disclosed ⁠a dark-web leak of 3,897 customer records last month. Spandana Sphoorty Financial, a non-bank lender, reported unauthorised debits from a bank account on November 1, and AU Small Finance Bank said it was probing a potential customer-data leak.

CERT-In did not say which incidents were linked to Crafty Falcon.