CERT-In warns NBFCs and fintech firms of AI-driven attacks

The Indian Computer Emergency Response Team (CERT-In) has issued a warning to non-banking financial corporations (NBFCs) and fintech firms about AI-driven attacks. The threat campaign, named CRAFTY FALCON, is described as an "AI-assisted financial threat actor" that uses machine intelligence to survey targets, operate at high speeds, and strike using victims' own payment and disbursement APIs.

This advisory comes after an analysis of incidents reported by various entities such as NBFCs, digital lending platforms, fintech entities, payment aggregators, payment service providers, and cryptocurrency exchanges/virtual digital asset service providers. These entities have reported significant escalation of this campaign. CERT-In warns that the threat is still active and urges BFSI entities to treat it as an "immediate and continuing threat".

Reported attacks include exploitation of merchant settlement APIs of payment aggregators, theft of wallet keys from cryptocurrency exchanges and virtual digital asset service providers, and repeated attacks on these companies. CERT-In's analysis reveals the use of multiple publicly available AI-driven offensive security tools, including ARTEX family of LLM-based, PentAGI autonomous multi-agent AI penetration testing system, Cairn attack search engine, and CyberStrikeAI framework.

The advisory also highlights that such attacks have been observed globally, with Google's Threat Intelligence Group reporting AI offensive security tools being used in real-world intrusions across the US and Europe.