“incomplete remediation,” the Indian Computer Emergency Response Team (CERT-In) warned on November 4, after a wave of repeat intrusions showed organisations had not closed the pathways their attackers were exploiting.
CERT-In flags Crafty Falcon targeting non-banking financial firms and crypto platforms
In a security advisory published on November 4, CERT-In’s Finance branch (CERT-Fin) identified a previously undocumented threat actor it calls “Crafty Falcon” and said successive attacks have hit non-banking financial companies across India. The advisory names affected sectors specifically: digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges. CERT-In said some organisations had received a restricted-distribution advisory in early October about API exploitation for unauthorized transfers, but were attacked again despite remediation efforts.
Crafty Falcon’s attack lifecycle: from non-production to high-value transfers
CERT-Fin lays out a repeatable pattern. Initial access is commonly obtained through internet-exposed non-production environments — user acceptance testing (UAT), staging and testing systems. From there, attackers move into production by abusing shared credentials, authentication tokens or network paths. The actor reverse-engineers application codebases, crafts altered application packages and makes unauthorized API calls that bypass server-side assumptions that only legitimate client applications will connect.
To avoid IP-based controls, Crafty Falcon routes traffic via whitelisted third-party fetcher IP pools — for example, content-acceleration services and app-store review fetchers — which can be instructed to fetch arbitrary URLs and thus originate traffic from already-trusted addresses. The actor also targets cloud infrastructure and management services: CERT-In specifically cites abuse of “AWS Systems Manager and Lambda” to execute commands and deploy malicious files, enabling activity that blends with legitimate cloud management operations.
Before siphoning large sums, the actor performs micro-value test transactions — CERT-In gives the concrete example of transactions of Rs. 1 — to confirm that unauthorized fund flows are possible, then exploits merchant settlement APIs of payment aggregators and steals cryptocurrency wallet keys from exchanges and virtual digital asset service providers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAI and agentic offensive tooling observed: ARTEX, CyberStrikeAI and Cairn
CERT-In reports that Crafty Falcon uses a range of AI and agentic AI penetration-testing tools and that the attacker’s behavior — rapid generation and refinement of large numbers of tailored scripts and functionally identical variants — is consistent with AI-generated code and iterative AI-assisted development. The advisory names three specific tools:
- ARTEX, a penetration testing tool based on PetAGI, an autonomous, multi-agent framework that can be plugged to large language models (LLMs)
- CyberStrikeAI, described as a penetration testing framework
- Cairn, described as an attack search engine
CERT-In warned these tools enable “complete attack chains autonomously at machine speed,” allowing attackers to adapt payloads based on target responses. The agency also noted that while the tools are publicly available and could be used by many actors, “most previous malicious campaigns where they were deployed were linked to China-based actors.”
CERT-In’s mitigation checklist for finance, payments and cloud teams
The advisory provides a long list of concrete mitigations aimed at closing the specific techniques Crafty Falcon uses. Notable recommendations include:
- Maintain heightened 24/7 security monitoring, increase staffing and lower alert thresholds during holidays, weekends and other low-monitoring windows
- Centralize real-time monitoring of cloud audit logs and alert on high-risk events such as remote command execution, serverless function code updates and creation of roles, users or access keys
- Restrict cloud management and serverless execution to approved principals and accounts; implement instance metadata service protections, least-privilege roles, restrictions on wildcard egress and default-deny internet egress for serverless functions
- Separate UAT, staging and testing from production; remove shared credentials, tokens, API keys, databases or direct network paths
- Treat client applications and packages as untrusted: enforce server-side transaction validation, API request signing using nonces and timestamps, application attestation and certificate pinning
- Rapidly patch Internet-facing applications with SLAs prioritizing file-upload and deserialization vulnerabilities in PHP and Node.js; use WAF virtual patching as an interim measure
- Monitor for small-value test transactions to new beneficiaries and treat such activity as an indicator of potential unauthorized fund transfers
- Store cryptocurrency wallet keys in hardware security modules or cold custody
- Prohibit unauthorized security and attack tools, including publicly available AI-driven offensive frameworks, on corporate infrastructure and monitor LLM API usage and keys
What this means for digital lenders, cryptocurrency exchanges, and cloud operations teams
Digital lenders and payment service providers need to harden non-production environments and sever credential and network linkages to production: CERT-In’s advisory makes separation and removal of shared credentials a central defensive requirement. Cryptocurrency exchanges and virtual asset service providers face the specific risk of wallet key theft and are advised to move keys into hardware security modules or cold custody. Cloud operations and DevOps teams must adopt tighter controls on cloud management services and serverless functions and bring audit-log monitoring and alerting into centralized, 24/7 workflows to spot the machine-speed, outside-business-hours activity CERT-In describes.
CERT-In asked organisations to report suspicious activity related to Crafty Falcon to incident@cert-in.org.in and to contact the Indian Cybercrime Coordination Centre (I4C) and its Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS). The advisory leaves no doubt: defenders must treat micro-transactions, unattended non-production exposure and rapid, AI-driven script generation as clear warning signs and remediate them comprehensively — not partially — to prevent repeat intrusions.
Source: https://www.infosecurity-magazine.com/news/india-warns-ai-cyberattacks/
