Indian cyber agency warns of AI-driven threat actor targeting financial APIs
CERT-In has identified a threat actor known as CRAFTY FALCON using AI tools to exploit payment APIs and conduct unauthorized fund transfers across the Indian financial sector.
India's Computer Emergency Response Team (CERT-In) has issued a security advisory detailing a campaign by a threat actor dubbed CRAFTY FALCON. The group is systematically targeting banking, financial services, and insurance (BFSI) entities by leveraging AI-driven offensive tools to compromise payment and disbursement APIs.
The agency reports that attackers utilize tools such as ARTEX and PentAGI to exploit cloud infrastructure, including AWS Systems Manager and Lambda. By gaining access through shared credentials in non-production environments, the group has successfully moved laterally into production systems. Once inside, they reverse-engineer application code to manipulate API requests, effectively bypassing standard transaction controls and security verification processes.
Data suggests the attackers frequently test compromised channels by conducting micro-value transactions before escalating to high-value thefts. CERT-In has mandated that financial institutions move toward 24/7 security monitoring, enforce strict segregation of testing environments from production, and implement real-time validation of all API traffic to mitigate further exposure.