CERT-In Names 'Crafty Falcon' Behind AI-Driven Attacks on Indian Lenders, Fintechs and Crypto Exchanges
India's CERT-In has designated a threat actor it calls Crafty Falcon as responsible for an escalating campaign against non-bank lenders, fintechs, payment firms and crypto exchanges, naming four AI offensive-security tools including ARTEX and PentAGI. The November 4 advisory, rated critical, says the threat is active and that some firms were attacked again after incomplete fixes. CERT-In did not say who is behind it or name victims.
India's cyber agency is now telling its financial sector, in writing, that the attackers draining money through payment systems are using AI tools to do it at "machine speed." In advisory CIAD-2026-0058, issued on November 4 with a severity rating of critical, CERT-In says its finance unit, CSIRT-Fin, has designated the actor behind a run of break-ins as "CRAFTY FALCON."
What the advisory says#
The advisory updates an October 9 warning about attackers abusing payment and disbursement APIs to move money without authorization. It says the campaign has since escalated across non-bank finance companies, digital lenders, fintechs, payment aggregators and crypto exchanges, and calls the threat "active and ongoing." Firms that had received earlier restricted advisories and patched were "deliberately re-targeted," some after incomplete remediation, and attacks were timed for holidays and weekends.
CERT-In names four publicly available AI-driven offensive tools used against victims: the ARTEX family, the PentAGI multi-agent penetration-testing system, the Cairn attack search engine and the CyberStrikeAI framework. It says they run full attack chains autonomously and generate many tailored scripts in quick succession, a pattern it describes as consistent with AI-generated code.
The attack pattern it lists includes entry through internet-exposed test and staging systems before moving to production, abuse of cloud management services, ₹1 test transfers before larger ones, abuse of payment aggregators' merchant settlement APIs and theft of crypto wallet keys. Its recommendations include round-the-clock monitoring with extra staff on holidays, fully separating test environments from production, and treating any past incident as a possible ongoing intrusion.
What it leaves out#
CERT-In did not say who is behind Crafty Falcon, where it operates or which companies were hit, and it did not call the attacks state-sponsored, Reuters reported. Reuters said researchers have linked at least two of the four tools to China. ARTEX has been used against South Korean banks since late September, according to CrowdStrike, and its developer made it private last month, Reuters said.
The advisory follows a string of breach disclosures by Indian lenders, but CERT-In did not tie any specific incident to Crafty Falcon. Reuters previously reported, citing a police complaint, that two Mumbai non-bank lenders lost about $2 million in more than 700 unauthorized transfers in October. CERT-In last month separately reported AI agents exceeding their scope on live Indian systems.
Limits#
- CERT-In has not published how many entities were hit or how much money was lost.
- The link between the named tools and China comes from outside researchers cited by Reuters, not from CERT-In.
- We read a copy of the advisory hosted by MediaNama; CERT-In, the IT ministry and I4C did not respond to Reuters.