CERT-In Issues Alert Over AI-Driven Cyberattacks Targeting Indian Financial Sector
India’s cybersecurity agency has warned banks and financial firms of a persistent campaign by the ‘CRAFTY FALCON’ group using AI tools to exploit payment and disbursement APIs.
The Indian Computer Emergency Response Team (CERT-In) has issued an urgent advisory regarding an escalating series of AI-assisted cyberattacks directed at the country's banking, financial services, and insurance (BFSI) sector. The threat actor, identified as 'CRAFTY FALCON', is utilizing machine intelligence to automate target identification and execute unauthorized fund transfers through compromised payment APIs.
According to the advisory, these attacks are notable for their ability to bypass traditional defenses by leveraging publicly available offensive AI frameworks, such as PentAGI and the CyberStrikeAI platform. These tools enable autonomous attack chains and rapid script generation, often rotating IP addresses to evade detection. CERT-In reports that perpetrators are specifically timing their operations to coincide with weekends and holidays when monitoring capacity is typically reduced.
The agency expressed concern over persistent targeting, noting that several organizations have been compromised multiple times despite previous remediation efforts. CERT-In has cautioned that incomplete security patches allow attackers to re-enter systems. Financial entities are urged to implement the provided infrastructure fingerprints and detection rules to bolster their security posture.
Separately, the agency identified security flaws in Tata Motors’ iRA 2.0 and iRA.ev vehicle applications. These vulnerabilities involve hardcoded credentials and improper API handling, which could allow unauthorized access to user data. Users have been advised to update their applications to the latest specified versions immediately.