CERT-In warns financial firms as AI-driven ‘Crafty Falcon’ cyberattacks escalate

CERT-In has warned banks, NBFCs and fintech companies about escalating cyberattacks under the 'Crafty Falcon' campaign, which uses AI-powered tools to exploit vulnerabilities and facilitate unauthorised fund transfers. Attackers are targeting financial systems through compromised credentials, APIs and cloud infrastructure

New Delhi: The Indian Computer Emergency Response Team (CERT-In) has issued a fresh warning to banks, non-banking finance companies (NBFCs), fintech firms and other financial institutions following a rise in cyber attacks linked to unauthorised fund transfers. CERT-In said it had observed a significant escalation in an ongoing cyber campaign, dubbed ‘Crafty Falcon’, which uses artificial intelligence-powered tools to automate attacks and rapidly exploit vulnerabilities in financial systems.

The advisory follows an earlier alert issued in October regarding the misuse of payment and disbursement application programming interfaces (APIs) to facilitate fraudulent fund transfers.

---

According to CERT-In, reports of successful intrusions continue to be received from banks, NBFCs and fintech companies, including some organisations that had already undertaken corrective measures after previous warnings. In several cases, attackers returned to target entities where identified weaknesses had not been fully addressed.

Attackers have increasingly timed their operations to coincide with weekends, holidays and other periods of reduced security oversight, making detection and response more difficult, the watchdog said.

CERT-In’s investigation found that threat actors are leveraging publicly available AI-driven offensive security platforms capable of generating customised attack scripts, adapting malware based on system responses and carrying out large parts of the attack process with minimal human intervention.

Moreover, attackers are exploiting internet-facing testing environments, cloud infrastructure, application vulnerabilities and compromised credentials to gain access to critical systems. Modified mobile applications and unauthorised API calls have been used to initiate fraudulent transactions.

The advisory also highlighted tactics such as routing malicious traffic through trusted third-party services to bypass security controls and using low-value transactions to test compromised systems before attempting larger fund transfers.

Earlier in October, several lenders witnessed cyberattacks, including leading banking firms State Bank of India, AU Small Finance Bank and Spandana Sphoorty.