"The same entities have been deliberately re-targeted, including after incomplete remediation and attacks have been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response," the Indian Computer Emergency Response Team warned.
CERT‑IN gives the adversary a name: CRAFTY FALCON
India’s national cyber incident response authority has assigned the label CRAFTY FALCON to what it describes as an “AI‑assisted financial threat actor.” CERT‑IN says it first detected the activity in October and issued an advisory directed at digital lending platforms, fintech entities, payment service providers, and wallet operators. According to the advisory, attackers are probing internet‑facing applications, exposed APIs and privileged endpoints; when they find a path in, the adversary attempts to use payment APIs to steal money.
AI‑enhanced tools and rapid variant development
CERT‑IN attributes the campaign to attackers using AI‑enhanced tooling including the ARTEX pen‑testing tool, the Cairn attack search engine, and the CyberStrikeAI framework. The advisory says those tools “have been linked to users who appear to speak Chinese.” It also highlights a development pattern: many “functionally identical variants refined in rapid succession,” which CERT‑IN describes as consistent with AI‑generated code and iterative AI‑assisted development. The crew also quickly weaponizes newly discovered vulnerabilities to keep attacks fresh.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTactics: test and development exposure, app rewriting, and micro‑payments
CRAFTY FALCON’s operational playbook focuses on low‑visibility entry points. The crew searches for internet‑exposed environments used for testing or development and harvests artefacts — shared credentials, tokens, network paths — that make lateral movement into production systems possible. Once inside, CERT‑IN reports, the attackers re‑write victims’ applications so they perform unauthorized API calls. Because the altered applications appear legitimate to downstream defenses, those API calls are often not flagged as malicious.
To verify whether their manipulations will succeed, attackers reportedly make tiny payments of roughly $0.01 as a probing mechanism; successful tests are followed by larger fraudulent transfers. When the target is a cryptocurrency exchange or virtual digital asset service provider, CERT‑IN says the crew steals wallet keys and empties cryptocurrency wallets.
CERT‑IN’s operational advice: logs, real‑time monitoring, and isolation
The advisory recommends upgrading event‑logging and real‑time anomaly monitoring and ensuring alerting is effective — measures CERT‑IN says are essential given the campaign’s speed and stealth. It urges organisations to keep test environments off the internet, restrict access to cloud resources that adversaries favour to run attacks, and maintain 24x7 monitoring because the attacks are “active and escalating.” The advisory’s practical tone prompted the article to note that observers of the security marketplace should expect demand for observability tools to rise immediately: “Vendors of observability tools will be warming up their Indian sales teams today,” the report commented.
What this means for fintechs, cryptocurrency services, and observability vendors
- Fintechs, digital lenders, payment service providers and wallet operators — CERT‑IN explicitly named these businesses as reporting attacks and advised them to treat remediation as binary: incomplete fixes invite re‑targeting. They must remove internet exposure from test and development assets, harden API authentication, and assume weekend and holiday windows are high risk.
- Cryptocurrency exchanges and virtual digital asset service providers — the advisory warns of wallet‑key theft and full wallet drain, underscoring the specific risk to custodial systems and key management processes.
- Observability vendors and security tool vendors — CERT‑IN’s emphasis on enhanced logging, real‑time monitoring and alerts creates a near‑term market opportunity to sell improved telemetry, detection and incident response capabilities to organisations now being urged into 24x7 operations.
The Register, reporting on the advisory, pointed out that although CERT‑IN mentioned “entities” across banking, financial services and insurance, only the fintech and payments types listed above were named as having reported incidents. The Register noted that India’s thousands of banks — many small operations that sometimes lack basic infosec protections — create a target‑rich environment should CRAFTY FALCON choose to widen its footprint.
CRAFTY FALCON’s combination of AI‑assisted toolsets, automation that generates rapid functional variants, and a preference for low‑monitoring windows presents a distinct challenge: defenders must close obvious exposure (test/dev on the internet, shared credentials, lax cloud access) and operate continuous, high‑fidelity monitoring to catch small test transactions before they become large losses. CERT‑IN has signalled urgency; the practical question left by the advisory is whether organisations that have already been breached will complete remediation quickly enough to avoid deliberate re‑targeting.
