India identifies AI-driven hacking group targeting financial firms

The rise of Crafty Falcon

India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has officially named a hacking group known as Crafty Falcon. The agency issued an advisory identifying the group as the primary actor behind a recent wave of cyberattacks targeting the nation's financial sector. These attacks have specifically hit non-bank lenders, fintech companies, and cryptocurrency exchanges.

The agency noted that the threat remains active and ongoing across the country. While CERT-In did not specify the exact origin or identity of the group, it highlighted a disturbing trend in how these actors operate. The group is leveraging sophisticated methods to penetrate secure financial environments, causing significant concern for national infrastructure.

This identification comes as the Reserve Bank of India has been tightening cybersecurity checks. Despite these increased measures, the group has continued to successfully breach multiple institutions. The agency's warning serves as a notice to firms that their current defenses may not be sufficient against these specific automated tactics.

AI tools and machine speed

A defining characteristic of Crafty Falcon's methodology is the use of publicly available AI tools to automate the hacking process. CERT-In identified four specific tools used in these campaigns: ARTEX, PentAGI, Cairn, and CyberStrikeAI. By using these tools, the attackers are able to conduct break-ins at what the agency describes as 'machine speed,' making it difficult for human defenders to react in real-time.

The group is reported to use machine intelligence to survey its targets before launching an attack. This allows them to identify the most vulnerable points in a company's digital architecture with high precision. Once a target is identified, the AI-driven tools can rapidly execute the breach, often moving through systems faster than traditional security protocols can flag them.

Security researchers have already begun connecting these tools to broader geopolitical interests. At least two of the four tools named by CERT-In have been linked to China. For example, the China-made tool ARTEX was reportedly used in attacks against South Korean banks and in an espionage campaign targeting over 200 organizations across 14 different countries.

Exploiting payment interfaces

The technical execution of these attacks often involves compromising application programming interfaces, or APIs. These are the software links that allow banks to connect with non-bank lenders and fintech firms to send instructions for loan disbursements. By compromising these links, hackers can gain unauthorized access to the movement of funds.

Crafty Falcon specifically targets payment interfaces to move money by invoking the victims' own payment and disbursement systems. This method is particularly effective because it uses the legitimate infrastructure of the company against itself. Instead of creating a fake payment, the attackers trick the system into sending out real money from the victim's accounts.

The group also demonstrates persistence by re-attacking firms that had previously patched their vulnerabilities. CERT-In noted that if a remediation was incomplete, the hackers would strike the same flaw again. This suggests a systematic approach where the group monitors the progress of security fixes to find remaining openings.

Impact on Indian finance

The real-world consequences of these attacks have already been felt by several major Indian financial institutions. For instance, a police complaint revealed that two Mumbai-based non-bank lenders lost roughly $2 million in more than 700 unauthorized transfers from ICICI Bank accounts in early October. These transfers were made via compromised APIs used for loan instructions.

Other institutions have also reported significant security incidents during this period. The State Bank of India disclosed a dark-web leak involving 3,897 customer records, while Spandana Sphoorty Financial reported unauthorized debits from a bank account. Additionally, AU Small Finance Bank is currently investigating a potential leak of customer data.

To evade detection, the hacking group often times its activities during periods of low human monitoring. This includes targeting systems during holidays, weekends, and other off-peak hours. By operating when security teams are less active, the group can maintain access to systems for longer periods before the breach is discovered.

The evolving threat landscape

The use of freely available AI tools by groups like Crafty Falcon lowers the barrier to entry for sophisticated cybercrime. While some tools like ARTEX were recently made private by their developers following the South Korean attacks, the underlying methodology remains a significant risk. The fact that these tools were once public means that many actors can now deploy high-level hacking capabilities without deep engineering expertise.

The Indian government and its cybersecurity agencies are now tasked with defending against a threat that evolves as quickly as the AI models used to create it. Because the attacks are automated, the defense must also become more automated and intelligent. This shift requires a move toward real-time monitoring and faster response capabilities to counter 'machine speed' threats.

Moving forward, the focus will likely shift toward securing APIs and payment interfaces more rigorously. As more financial services move to interconnected models, the points of connection between different companies become the primary battleground. Organizations must ensure that any remediation of a security flaw is complete and verified to prevent the group from returning to the same vulnerability.