CERT-In warns financial firms of CRAFTY FALCON attacks

CERT-In’s finance incident-response team designated the threat actor CRAFTY FALCON, and rated its advisory critical.[1] The advisory’s original issue date was November 4, 2026.[1] CERT-In said the campaign targets NBFCs, digital lending platforms, fintech entities, payment aggregators, payment service providers and cryptocurrency exchanges.[1] It described the activity as active and ongoing, with successful attacks still being reported.[1] CERT-In also said some organisations that had previously been warned were deliberately targeted again after incomplete remediation.[1]

CERT-In said CRAFTY FALCON uses machine intelligence to survey targets and invokes victims’ payment and disbursement APIs at machine speed.[1] It listed ARTEX, PentAGI, Cairn and the CyberStrikeAI framework among the tools involved.[1] The agency described ARTEX as a family of large-language-model-based tools, PentAGI as an autonomous multi-agent AI penetration-testing system, and Cairn as an attack search engine.[1] CERT-In said the tools can execute attack chains, refine tailored scripts and adapt payloads to target responses.[1]

CERT-In said attackers targeted cloud compute, serverless and management services, including AWS Systems Manager and Lambda, to run commands and deploy malicious files.[1] It also reported intrusions through exposed testing and staging environments, followed by movement into production via shared credentials, tokens or network paths.[1] Other methods included reverse-engineering application code to make unauthorised API calls, bypassing IP allow-lists through shared fetcher services, and exploiting newly published vulnerabilities.[1] CERT-In said attackers used transactions as small as Rs. 1 to test unauthorised fund flows, and exploited merchant settlement APIs to move funds.[1]

CERT-In advised heightened 24/7 monitoring, with extra staffing and lower alert thresholds during holidays, weekends and other periods of low coverage.[1] It said attackers timed some operations for these periods to delay detection and response.[1] The agency recommended fully eradicating threats, verifying remediation through forensics and continuing periodic threat hunting after an incident.[1] It also advised separating testing, staging and user-acceptance environments from production, with no shared credentials, tokens, API keys, databases or direct network paths.[1] For payment controls, it recommended server-side validation and signed API requests with a nonce and timestamp.[1]