India’s cybersecurity agency has named Crafty Falcon as the threat actor behind an ongoing campaign using artificial intelligence to attack financial firms, including non-bank lenders, fintechs, and cryptocurrency exchanges.
The Computer Emergency Response Team of India, in an advisory issued Wednesday, identified four AI-driven tools used in the campaign, including ARTEX, PentAGI, Cairn, and CyberStrikeAI.
According to the notice, Crafty Falcon uses AI to survey targets and invokes victims’ own payment and disbursement APIs to move funds. Attackers also carried out small test transactions before larger transfers and exploited merchant settlement APIs.
CERT-In said some organizations were attacked again after earlier remediation efforts, with most attacks observed around weekends, holidays, and other periods of lower monitoring.
"Treat this campaign as active and escalating," the agency warned, urging companies to bolster security monitoring around the clock. Banks and fintechs should also increase the number of employees during off-peak periods.
The advisory did not identify affected companies or state how much money was stolen. It also did not attribute the campaign to a government or identify who operates Crafty Falcon.
At least two of the four tools identified by CERT-In have been linked by security researchers to China. ARTEX, a China-made tool, has also been used in attacks against South Korean banks, while CrowdStrike said last month that a China-linked group used it in an espionage campaign targeting more than 200 organizations across at least 14 countries.