Threat actor targets Indian fintechs on weekends when defenders aren’t watching

India's Computer Emergency Response Team (CERT-IN) has issued a warning regarding a significant escalation in cyberattacks on the nation's financial sector. The attacks are allegedly carried out by an AI-assisted threat actor known as "CRAFTY FALCON." CERT-IN had first detected the attacks in October and issued an advisory, warning digital lending platforms, fintech entities, payment service providers, and wallet operators of the threat.

The attacks have been timed to occur during low-monitoring windows, such as weekends and holidays, to delay detection and response efforts. CRAFTY FALCON uses AI-enhanced tools such as ARTEX, Cairn, and CyberStrikeAI to target internet-facing applications, exposed APIs, and privileged endpoints. Once inside a system, the attackers rewrite the applications to make unauthorized API calls, often resulting in small payments to test the effectiveness of the attacks.

If successful, larger payments are made, and in the case of cryptocurrency exchanges, the attackers steal wallet keys and empty cryptocurrency wallets. CERT-IN has urged businesses to improve their event logging, real-time monitoring, and alert systems, as well as to keep test environments off the internet and restrict access to cloud resources.

The threat actor's tactics include creating many functionally identical variants of code to avoid detection, using AI-generated code and iterative AI-assisted development, and rapidly exploiting newly discovered vulnerabilities.