CERT-In Warns of AI Cyberattacks on Indian Financial Firms

CERT-In warns Indian financial firms of AI-driven cyberattacks targeting payment systems, cloud infrastructure and cryptocurrency exchanges.

By News National Editorial Team

India's cybersecurity agency has issued a critical warning about an ongoing campaign of artificial intelligence-assisted cyberattacks targeting financial institutions, including non-banking financial companies, fintech businesses and cryptocurrency exchanges.

The Indian Computer Emergency Response Team (CERT-In) said attackers are using AI-powered tools to identify weaknesses, gain access to computer systems and exploit payment infrastructure to transfer money without authorisation. The campaign has been identified as CRAFTY FALCON.

In advisories issued on November 3 and 4, CERT-In and the Indian Cyber Crime Coordination Centre (I4C) warned that the attacks could result in substantial financial losses. The agencies said the campaign remained active and that some organisations previously targeted had been attacked again.

How the attacks work

According to the November 4 CERT-In advisory, attackers are using publicly available AI-assisted security tools to automate different stages of cyber intrusions.

These tools can generate customised attack scripts, adapt their methods in response to a target's security systems and execute multiple steps with limited human involvement.

The agency identified several tools associated with the campaign, including ARTEX, PentAGI, Cairn and CyberStrikeAI.

Investigators found that attackers were targeting cloud infrastructure, internet-facing servers and software environments used for testing applications. In some cases, weaknesses in testing systems reportedly allowed attackers to move into production environments.

Once inside, attackers could exploit payment application programming interfaces, commonly known as APIs, and automated fund-disbursement systems.

The money was then transferred to accounts used as intermediaries, commonly referred to as mule accounts. Investigators said the funds could be quickly moved or withdrawn through banking channels such as the Immediate Payment Service and National Electronic Funds Transfer.

Why financial companies are vulnerable

India's financial sector increasingly depends on connected digital systems. Banks, lenders, payment providers and fintech companies often rely on third-party software, cloud services and automated payment infrastructure.

These connections can create additional entry points for attackers when security controls are incomplete.

CERT-In also warned that attackers were targeting cryptocurrency exchanges and attempting to steal wallet keys. Some attacks were reportedly timed to coincide with weekends and holidays, when fewer security personnel might be available to respond.

The agency said that organisations which had already taken corrective measures were among those targeted again, highlighting the importance of continuously reviewing security systems.

What institutions have been advised to do

CERT-In has called for stronger access controls, continuous monitoring of cloud systems, separation of testing and production environments, and improved protection of payment APIs.

Financial institutions have also been advised to monitor unusual transaction patterns, introduce limits for new beneficiaries and investigate small test transactions that are followed by larger transfers.

The November 4 advisory also called for immediate action to isolate affected systems and report incidents to the appropriate authorities.

CERT-In's warning underscores a broader challenge facing India's digital economy: the same automation that makes financial services faster and more accessible can also help criminals scale their attacks.

AI does not eliminate the need for human oversight. Instead, the warning highlights the importance of secure software development, effective monitoring and rapid incident response.

For customers, the advisory does not establish that all financial institutions have been compromised. However, it reinforces the need to use official banking channels, protect account credentials and report suspicious transactions immediately.

The campaign remains under investigation, and the full scale of the financial losses has not been publicly established.