CERT-In warns NBFCs and fintech firms of AI-driven attacks

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory warning that hackers are attacking non-banking financial corporations with the help of artificial intelligence. 

Terming the threat campaign "CRAFTY FALCON", the government body describes it as an “AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs.”

CERT-In is the national nodal agency for responding to computer security incidents.

“Continued analysis of incidents reported by affected entities including non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment aggregators, payment service providers and cryptocurrency exchanges / virtual digital asset service providers has revealed a significant escalation of this campaign.”

The advisory further said the threat is still active and has warned BFSI (banking, financial services, and insurance) entities to treat it as an “immediate and continuing threat”.

Outlining some of the reported attacks, the advisory said merchant settlement APIs of payment aggregators were exploited or abused to move funds. Cryptocurrency exchanges and virtual digital asset service providers were also targeted, with wallet keys stolen and funds siphoned from cryptocurrency wallets. 

The advisory mentioned that the same companies have faced repeated attacks. 

The body also revealed that its analysis has shown the use of multiple publicly available AI-driven offensive security tools. These include the 'ARTEX' family of LLM-based, 'PentAGI' autonomous multi-agent AI penetration testing system, the 'Cairn' attack search engine, and the 'CyberStrikeAI' framework. 

Last month, CERT-In had flagged incidents involving AI agents exceeding their authorised tasks and accessing live systems of Indian organisations, alongside financially motivated attacks using open-source agentic AI tools. Globally too, such attacks have been on the rise. Google’s Threat Intelligence Group reported observing AI offensive security tools being used in real-world intrusions, including attacks on organisations across the Unoted States and Europe.

Edited by Swetha Kannan