India’s Computer Emergency Response Team, CERT-In, has issued a critical warning about escalating AI-assisted attacks on banking, financial services and insurance entities, including repeat targeting after incomplete remediation. Its Nov. 4 CRAFTY FALCON advisory describes an ongoing campaign that abuses financial institutions’ own cloud services and payment interfaces to move funds.
Cryptocurrency exchanges and virtual digital asset service providers are among the affected categories. CERT-In reports stolen wallet keys and funds siphoned from cryptocurrency wallets, placing crypto custody within a broader warning that also covers non-bank financial companies, digital lending platforms, fintech firms and payment providers. The public advisory does not name an affected exchange or quantify the losses.
The notice updates CERT-In’s Oct. 9 advisory on unauthorized fund transfers through payment and disbursement APIs, the interfaces applications use to request those transactions. @IndianCERT announced the new advisory on Nov. 4. The agency says its finance response team, CSIRT-Fin, has designated the actor behind the campaign CRAFTY FALCON.
CERT-In says it continues to receive reports of successful attacks involving NBFCs and fintech entities that had received earlier restricted warnings and undertaken remediation. It specifically identifies re-targeting after incomplete remediation, with attacks timed for holidays, weekends and other periods of reduced monitoring.
How the campaign reaches financial systems
CERT-In describes several routes through institutions’ infrastructure. Internet-facing testing and staging environments have provided entry points, followed by access to production systems through shared credentials, tokens or network connections. Modified application packages have also been used to initiate unauthorized API calls, defeating controls that assumed requests would come only from the legitimate application.
Cloud management channels are another reported avenue. The advisory says services including AWS Systems Manager and Lambda were abused to execute commands and deploy malicious files, allowing hostile activity to blend into legitimate administration.
Even restricting access to approved IP addresses can leave an opening. CERT-In says attackers originated traffic from shared third-party fetcher pools that institutions had allow-listed. It recommends replacing that reliance with controls that authenticate the requesting party, such as mutual TLS, cryptographically signed requests or scoped API keys on dedicated vendor endpoints.
The agency also describes micro-value test transactions, such as one rupee, used to check unauthorized fund flows before larger transfers. Merchant settlement APIs used by payment aggregators were exploited or abused as well.
CERT-In attributes the campaign’s AI assistance to its incident analysis. It identifies publicly available offensive-security tools including ARTEX, PentAGI, Cairn and CyberStrikeAI, alongside rapid production of tailored scripts and payloads that adapt to target responses. Those descriptions are the agency’s assessment of the activity.
CERT-In calls for heightened round-the-clock monitoring, with more coverage during weekends, holidays and other periods when an attack could go unnoticed longer.
For institutions recovering from an incident, the advisory recommends forensic verification that the intrusion has been eradicated, followed by continued threat hunting.
The technical controls include separating testing environments from production, restricting cloud privileges, rapidly patching exposed applications and enforcing transaction rules on the server. Signed API requests add another check on whether a payment instruction should be accepted.
Transaction monitoring should also connect small test payments with subsequent high-value transfers.
Protecting crypto wallet keys
For crypto service providers, CERT-In recommends storing wallet keys in hardware security modules or cold custody, requiring multi-signature approvals for withdrawals and monitoring withdrawal patterns for anomalies. Keys should be rotated immediately when compromise is suspected.
CERT-In says it has shared the full indicators of compromise, infrastructure fingerprints and detection rules with BFSI entities through restricted advisories. Its public warning cautions against limiting the response to blocking indicators, alongside its recommendations for continued threat hunting and verified eradication.
