India’s Computer Emergency Response Team (CERT-In) has issued a critical update highlighting advanced AI-assisted attacks by threat actor 'CRAFTY FALCON' on payment APIs of banking, financial services, and insurance (BFSI) entities, aiming at unauthorized fund transfers through sophisticated exploitation techniques.
- AI-driven threat actor exploits BFSI payment APIs for fund theft
- Attackers use cloud abuse, credential leaks, and custom exploits
- CERT-In urges continuous monitoring, rapid patching, and strict transaction controls
What happened
CERT-In updated its advisory on November 4 to report that the threat actor labeled 'CRAFTY FALCON' is leveraging a suite of AI-driven offensive tools to target payment and disbursement APIs within the Indian BFSI sector. The attackers exploit cloud services including AWS Systems Manager and Lambda, and gain access to production environments through shared tokens and credentials from exposed testing systems. They reverse-engineer application code to craft tailored exploits and execute unauthorized API requests.
In the course of these attacks, CRAFTY FALCON bypasses IP allow-listing by routing traffic through third-party IP pools and performs micro-value transactions as probes before initiating larger unauthorized transfers. Additional methods include exploiting vulnerabilities in PHP and Node.js applications, stealing cryptocurrency keys, and continuing operations even after initial remediation by targeted entities.
Why it matters
This escalation marks a significant evolution in cyber threats facing India’s BFSI ecosystem, combining AI automation with traditional intrusion techniques to increase attack sophistication and speed. The deployment of autonomous AI penetration testing and attack search engines considerably lowers the barrier for threat actors to discover and exploit vulnerabilities quickly, posing a heightened risk to financial stability and customer assets.
The persistent nature of these attacks, including during weekends and on remediated systems, demonstrates attackers’ capability to maintain clandestine access and execute payloads without detection. This calls for a reassessment of defenses including stringent isolation of environments, enhanced monitoring, and strengthening security controls specifically around API transactions and cloud infrastructure.
What to watch next
It will also be essential to monitor patterns of micro-value transactions which may signal probing activities preceding major frauds, alongside enforcing beneficiary cooling periods and multi-signature requirements for large or cryptocurrency withdrawals. Observing the threat actor’s tactics and adapting defenses to evolving AI-augmented attack tools should remain a priority to stay ahead of future incidents.