Threat actor targets Indian fintechs on weekends when defenders aren’t watching
CERT-IN warns of ‘significant escalation’ in AI-powered attacks, some after victims tried to improve defences
India's Computer Emergency Response Team has issued a warning about a surge in attacks from an AI-enhanced threat actor known as "CRAFTY FALCON" targeting Indian financial services, with a particular focus on weekends and holidays. CERT-IN first identified the attacks in October, advising digital lending firms, fintech companies, payment service providers, and wallet operators to safeguard internet-facing applications, exposed APIs, and privileged endpoints.
The attackers utilize payment APIs to siphon funds and have been found to re-target victims who had previously remediated their systems. CRAFTY FALCON employs tools like ARTEX, Cairn, and CyberStrikeAI, all of which are linked to Chinese speakers. The group infiltrates internet-exposed environments used for testing or development, exploits newly discovered vulnerabilities, and tests its attacks with small transactions before escalating to larger ones, particularly targeting cryptocurrency exchanges.
CERT-IN recommends enhancing event logging, real-time monitoring, alerting, and restricting access to cloud resources. The warning is especially pertinent given India's vast banking and financial ecosystem, many of which may lack robust cybersecurity measures.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
