Cert-In: AI Cyber Gang Targets Banks, Fintech Firms

New Delhi: India's cybersecurity watchdog Cert-In on Wednesday issued a critical advisory to banks and financial institutions over an escalating campaign of AI-assisted cyberattacks involving unauthorised fund transfers, warning that the threat remained active and ongoing.

The Indian Computer Emergency Response Team (Cert-In) identified the threat actor as 'Crafty Falcon', which uses publicly available artificial intelligence tools to carry out sophisticated cyberattacks at machine speed by exploiting payment and disbursement systems.

The advisory, an update to an October 9 warning, said the campaign had targeted non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers and cryptocurrency exchanges.

According to Cert-In, the attackers use AI-driven tools to identify vulnerabilities, generate customised attack scripts and execute sequences of attacks autonomously. They exploit the targeted institutions' own payment and disbursement application programming interfaces (APIs) to initiate unauthorised fund transfers.

"The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation," the advisory said.

The agency warned that some institutions had been deliberately targeted again, including after incomplete remedial measures. Attacks were also timed to coincide with holidays, weekends and periods of reduced security monitoring to delay detection.

Cert-In identified several publicly available AI-powered offensive security tools being used in the campaign, including ARTEX, PentAGI, Cairn and CyberStrikeAI.

"These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses," the advisory said.

The cybersecurity agency urged all banking, financial services and insurance (BFSI) entities to maintain heightened round-the-clock monitoring, increase security staffing and lower alert thresholds during holidays and weekends.

"All BFSI entities are strongly advised to treat this campaign as an immediate and continuing threat," it warned.

The agency also recommended stronger access controls, continuous monitoring of suspicious activity and immediate reporting of suspected security breaches.