CERT-In Sounds Alarm Over AI-Powered 'Crafty Falcon' Cyberattacks Targeting Financial Institutions

New Delhi- India's cybersecurity watchdog CERT-In has issued a fresh alert to banks, non-banking financial companies (NBFCs), fintech firms and other financial institutions as AI-powered cyberattacks targeting financial systems and facilitating unauthorised fund transfers continue to escalate.

The Indian Computer Emergency Response Team (CERT-In) said it had detected a significant increase in an ongoing cyber campaign known as 'Crafty Falcon', in which attackers are using artificial intelligence tools to automate malicious activities, exploit system vulnerabilities and carry out fraudulent transactions.

The latest advisory follows an alert issued in October about the misuse of payment and disbursement application programming interfaces (APIs) to execute unauthorised fund transfers.

According to CERT-In, it continues to receive reports of successful cyber intrusions from banks, NBFCs and fintech companies. Alarmingly, some of the affected organisations had already introduced corrective measures following earlier warnings, indicating that security gaps remain unresolved in several cases.

Investigations revealed that attackers were returning to target organisations where previously identified vulnerabilities had not been completely fixed.

The cybersecurity agency also flagged a shift in the timing of these attacks. Cybercriminals are increasingly exploiting weekends, public holidays and other periods when security teams may have limited oversight, reducing the chances of timely detection and response.

A particularly concerning aspect of the campaign is the use of publicly available AI-powered offensive security platforms. These tools allow attackers to generate customised attack scripts, modify malware in response to system behaviour and automate significant portions of cyber operations with minimal human involvement.

CERT-In identified several methods being used to compromise financial institutions, including exploiting internet-facing testing environments, cloud infrastructure, application vulnerabilities and stolen login credentials.

Attackers have also reportedly used modified mobile applications and unauthorised API calls to initiate fraudulent financial transactions.

The advisory highlighted other sophisticated techniques, including routing malicious traffic through trusted third-party services to evade security controls. In some instances, cybercriminals first execute low-value transactions to check whether a compromised system can process unauthorised transfers before attempting to move larger sums.

The repeated targeting of financial institutions despite earlier security interventions underscores the need for continuous vulnerability assessments, stronger API security and closer monitoring of financial transactions, particularly during periods of reduced staffing.

The warning comes after several lenders faced cyberattacks in October, including major banking institutions such as the State Bank of India, AU Small Finance Bank and Spandana Sphoorty.

CERT-In's latest alert highlights the growing risks posed by AI-assisted cybercrime and the need for financial institutions to strengthen their security infrastructure against increasingly automated and adaptive threats.

Advertisement