India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has escalated its warning about an AI-assisted financial threat actor it has named CRAFTY FALCON. In an updated advisory released Wednesday, the agency said the group is actively targeting banks, non-bank lenders, fintech companies, payment service providers, and — for the first time — cryptocurrency exchanges directly.
CERT-In said the campaign remains active and ongoing despite earlier warnings and remediation efforts. Its financial sector response team, CSIRT-Fin, continues to receive reports of successful intrusions, including from entities that had already received restricted advisories and patched their systems. In some cases, the same firms were breached again after incomplete fixes. The attackers have stolen cryptocurrency wallet keys and drained funds, often timing operations for weekends and holidays when monitoring is lower and detection is delayed.
The agency did not name the affected exchanges or disclose the amount of money lost. Cointelegraph reached out to Indian platforms including CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex for comment.
According to CERT-In, CRAFTY FALCON surveys targets with machine intelligence, operates at machine speed, and exploits the victim's own payment and disbursement APIs to move funds. Attackers entered through internet-exposed testing and staging environments, then used shared credentials and access tokens to reach production systems. They targeted cloud infrastructure, abused management services such as AWS Systems Manager and Lambda, reverse-engineered application code, and used modified application packages to make unauthorized API calls.
The advisory identifies several publicly available AI-driven offensive security tools linked to the campaign, including the ARTEX family of large language model-based tools, the PentAGI autonomous multi-agent penetration testing system, the Cairn attack search engine, and the CyberStrikeAI framework. These tools can autonomously execute attack chains, generate and refine tailored scripts, and adapt payloads based on target responses. Attackers also used whitelisted third-party fetcher IP pools to bypass IP allow-listing and sent micro-value test transactions, such as 1 INR, before executing larger transfers.
Security leaders have warned that AI is widening the gap between attackers and defenders. Solana Foundation chief information security officer Michael Coates said defenders need access to the strongest AI tools, while TRM Labs head of policy Ari Redbord said attack techniques are moving faster than a single audit can account for. CERT-In has advised at-risk firms to treat the campaign as active and escalating, monitor systems around the clock, and lower alert thresholds during holidays and weekends.
