India's cybersecurity agency has named a hacking group involved in automated AI-based attacks on financial institutions, identifying several attack tools including two with known links to China.
- CERT-In identifies 'Crafty Falcon' hacking group targeting Indian financial firms
- Use of AI tools like ARTEX linked to China enables rapid automated intrusions
- Attacks exploit payment systems and coincide with low-monitoring times
What happened
India's cybersecurity agency, CERT-In, has publicly attributed a recent wave of AI-driven cyberattacks against financial institutions to a hacking group it calls 'Crafty Falcon.' This group has targeted non-bank lenders, fintech companies, and cryptocurrency exchanges within India by using automated AI tools to break into systems rapidly. Among the tools identified are ARTEX, PentAGI, Cairn, and CyberStrikeAI, with security researchers linking ARTEX and at least one other tool to China.
These attacks have occurred despite recent warnings issued by authorities and intensified cybersecurity protocols mandated by the Reserve Bank of India. The hacking activities have focused on exploiting vulnerabilities in bank application programming interfaces (APIs) and payment platforms, enabling unauthorized fund transfers and data breaches. CERT-In described the threat as active and ongoing, emphasizing the use of machine-powered targeting and timing attacks during weekends, holidays, or other periods when monitoring is lax.
Why it matters
The identification of AI-powered tools linked to China in these cyberattacks highlights the increasing sophistication and international scale of threats facing India's financial ecosystem. Automated attacks conducted at machine speed can overwhelm traditional defenses and cause significant financial and reputational damage. Indian financial institutions, including major banks and non-bank lenders, have faced multiple incidents such as data leaks and illicit fund transfers amounting to millions of dollars.
CERT-In's revelation underscores the challenges regulatory and cybersecurity bodies face in safeguarding digital financial infrastructure. The exploitation of legitimate payment interfaces and APIs points to potential systemic vulnerabilities that could be exploited repeatedly if not fully remediated. This scenario plays out against a backdrop of escalating geopolitical tensions and underscores the need for robust, adaptive cybersecurity frameworks tailored to counteract advanced persistent threats.
What to watch next
Close attention will be needed on how Indian regulators and financial firms respond to the ongoing attacks, especially concerning the enhancement of API security and the comprehensive patching of identified vulnerabilities. Monitoring the usage and distribution of AI hacking tools like ARTEX—recently privatized after exposure—will be crucial in assessing whether the threat landscape evolves or mitigates.
International collaboration and intelligence sharing might intensify as multiple countries, including South Korea, have experienced similar AI-driven cyber campaigns linked to Chinese entities. Additionally, developments regarding the attribution of these attacks, potential financial losses, and any resulting regulatory actions or policy updates by India’s cybersecurity and financial authorities will be significant indicators of the broader impact.