CERT-IN warns of escalating AI-assisted attacks on Indian financial firms by CRAFTY FALCON
- Severity
- High
- Sources
- 1
What happened
CERT-IN's update says CRAFTY FALCON, an AI-assisted actor it first detected in October, re-targets victims after incomplete remediation and times attacks for holidays and weekends. It uses ARTEX, Cairn and CyberStrikeAI, tools linked to Chinese-speaking users, and rewrites victim applications to make unauthorised payment API calls that evade allowlist-based detection. Small test transactions of about $0.01 precede larger transfers. Defenders should restrict internet exposure of test and development environments, tighten cloud access, improve logging and real-time anomaly alerting, and monitor 24x7. No CVE identifiers are given.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Take development and test environments off the internet and restrict access to cloud resources.
- Improve logging of events and monitor for anomalies in real time with alerting.
- Monitor around the clock, especially during holidays and weekends.
- Fully remediate any earlier incident, as the group has returned to victims after incomplete clean-up.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Threat actors
Products
Government agencies