India's cybersecurity agency CERT-In has issued a critical warning about an active hacking campaign targeting financial institutions, cryptocurrency exchanges and fintech companies. The group, identified as CRAFTY FALCON, uses artificial intelligence tools to automate intrusions, exploit vulnerable systems and steal financial assets.

An advisory dated November 4 describes how attackers exploit exposed testing environments, compromised credentials and payment APIs to move money. The agency says organisations are continuing to face attacks despite previous security fixes.

CRAFTY FALCON Uses AI Tools to Automate Cyberattacks

CERT-In has identified four publicly available offensive security tools associated with the campaign, including ARTEX, PentAGI, Cairn and CyberStrikeAI. These tools allow attackers to automate multiple stages of an intrusion, generate customised attack scripts and modify their methods according to how targeted systems respond.

The agency describes CRAFTY FALCON as an AI assisted threat actor that operates at machine speed and uses machine intelligence to identify and examine targets. Its supporting infrastructure also changes IP addresses within hours or days, complicating detection efforts.

The campaign has affected non banking financial companies, digital lending platforms, fintech businesses, payment aggregators, payment service providers and cryptocurrency exchanges. CERT-In confirmed that virtual digital asset service providers have suffered wallet key theft and unauthorised fund withdrawals.

Weak Testing Systems and Shared Credentials Open Entry Points

The attackers reportedly enter financial organisations through internet exposed testing, staging and user acceptance testing environments. These systems frequently contain shared credentials, access tokens or network connections that allow attackers to move into production infrastructure.

CERT-In also identified compromised cloud management services, including AWS Systems Manager and Lambda, being abused to execute commands and deploy malicious files. Attackers reverse engineer application code and use modified application packages to make unauthorised API requests directly.

Another technique involves exploiting trusted third party IP addresses used for content acceleration or application store reviews. Attackers can abuse these services to make requests that appear to originate from allowlisted infrastructure.

Before attempting substantial transfers, the group reportedly conducts small transactions, including payments worth ₹1, to confirm whether unauthorised fund movements are possible. Merchant settlement APIs and newly disclosed vulnerabilities in web applications have also been exploited.

Attackers Exploit Weekends and Repeat Intrusions After Fixes

CERT-In has warned that CRAFTY FALCON deliberately operates during weekends, holidays and other periods when organisations have fewer employees monitoring their systems. These quieter periods give attackers additional time to execute transactions and delay detection.

The agency has also received reports of successful attacks against financial companies that had previously received security advisories and attempted remediation. In some cases, attackers returned after organisations failed to completely resolve earlier vulnerabilities.

This continued targeting highlights a weakness in relying on individual security fixes without checking whether compromised credentials, API permissions, network connections and production access remain exposed.

CERT-In Calls for Stronger API Controls & Round the Clock Monitoring

CERT-In has called for continuous security monitoring, stricter server side validation and stronger approval mechanisms for financial transactions. Payment aggregators and financial institutions should independently verify settlement instructions rather than relying solely on application level checks.

For cryptocurrency businesses, the agency recommends storing wallet keys in hardware security modules or cold custody, requiring multisignature approval for withdrawals and monitoring unusual transaction patterns. Organisations should immediately rotate compromised credentials and isolate affected systems when suspicious activity is detected.

The advisory also recommends restricting unauthorised AI security tools on corporate infrastructure, monitoring suspicious AI related processes and strengthening identity based access controls. Financial institutions are urged to use automated security response systems capable of identifying and containing attacks outside business hours.

CERT-In has described the campaign as an immediate and continuing threat, urging affected organisations to report incidents and preserve relevant forensic evidence.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. India Records $19B in Taxable Crypto Activity
2. India Parliament Panel Cancels August 27 Crypto Hearing
3. India Issues New Crypto Tax Rules From 2026
4. India to Ban Bitchat: Jack Dorsey Pushes Back
5. India Is Crypto’s Largest Market, Says Coinbase CEO

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.