On 4 November, CERT-In published a security advisory warning India's non-bank financial sector about a previously undocumented threat actor it calls Crafty Falcon. The group uses AI and agentic AI penetration-testing tools, and some of its victims have been hit more than once.
Who is being targeted
The advisory names non-banking financial companies, digital lending platforms, fintechs, payment aggregators, payment service providers and cryptocurrency exchanges. Some of these firms had already received a restricted advisory in early October about attackers abusing payment and disbursement APIs to make unauthorised transfers. They fixed what they could and were attacked again. CERT-In put it down to "incomplete remediation."
Attacks tended to land on holidays, weekends and other low-monitoring windows.
How the attacks work
CERT-In's finance unit, CERT-Fin, describes this sequence:
- Initial access through non-production systems. Internet-exposed UAT, staging and test environments are the way in.
- Pivot to production using shared credentials, tokens or network paths between environments.
- Reverse-engineer the app and build tailored exploits, then use modified app packages to call APIs directly, bypassing controls that assume only the real client talks to them.
- Get around IP allow-lists by routing traffic through trusted third-party fetcher pools, such as content-acceleration services and app-store review fetchers.
- Abuse cloud management services like AWS Systems Manager and Lambda to run commands and drop files.
- Test with Rs 1 transfers, then move larger sums through merchant settlement APIs. Crypto exchanges also lose wallet keys.
The group produces large numbers of custom scripts in rapid, near-identical variants, a pattern CERT-In links to AI-generated code. It names three tools in use: ARTEX (built on the PentAGI multi-agent framework), CyberStrikeAI and the attack search engine Cairn. CERT-In says these let attackers run complete attack chains autonomously "at machine speed."
What CERT-In recommends
The mitigation list is long. These are the items I'd start with:
- 24/7 monitoring with more staff and lower alert thresholds during holidays and weekends
- Centralised, real-time monitoring of cloud audit logs, alerting on remote command execution, serverless code changes and new roles or keys
- Cloud management and serverless execution restricted to approved principals
- Least-privilege roles, metadata-service protection and default-deny egress for serverless functions
- Full separation of UAT, staging and test from production, with no shared credentials, tokens, keys, databases or network paths
What to take from it
Nothing here depends on a new exploit. Exposed staging boxes, shared secrets and weekend blind spots are old problems. The change is speed. With AI tooling, a small crew can churn out variants faster than a team that patched once and moved on can respond. If you run a lending or payments stack in India, start by checking whether anything in your test environment can reach production.
