Machine-Speed Financial Theft: CERT-In Names “CRAFTY FALCON” as AI-Assisted Threat Actor Escalates Attacks on BFSI Entities

India’s Computer Emergency Response Team (CERT-In) and its finance-focused unit CSIRT-Fin issued a Critical advisory on 4 November 2026 warning that an AI-assisted threat actor it has designated “CRAFTY FALCON” is conducting an escalating campaign against banking, financial services and insurance (BFSI) entities.

The advisory, CIAD-2026-0058, updates an earlier October warning and states that the actor surveys targets with machine intelligence, operates at machine speed, and steals funds by invoking the victims’ own payment and disbursement APIs.

The campaign has already hit non-banking financial companies (NBFCs), digital lenders, fintech platforms, payment aggregators, payment service providers, and cryptocurrency exchanges / virtual digital asset service providers.

CSIRT-Fin continues to receive reports of successful attacks, including against organisations that had already received restricted earlier advisories and conducted remediation.

The same entities have been deliberately re-targeted after incomplete clean-up.

Attacks are frequently timed for holidays, weekends and other low-monitoring periods.

How CRAFTY FALCON Operates

Analysis of incidents shows a consistent pattern that blends traditional weaknesses with AI-enabled scale and adaptation:

• Abuse of cloud management services (such as AWS Systems Manager and Lambda) to execute commands and deploy malicious files while blending into legitimate management channels.
• Use of internet-exposed non-production (UAT/staging/testing) environments as entry points, followed by movement into production via shared credentials, tokens or network paths.
• Reverse-engineering of application codebases to craft tailored exploits, then calling payment APIs with altered or repackaged client applications.
• Bypass of IP allow-lists by originating traffic from shared third-party fetcher pools (content-acceleration and app-store review services) that any internet user can instruct to fetch arbitrary URLs.
• Micro-value test transactions (as small as ₹1) to validate unauthorised fund flows before larger transfers.
• Exploitation of merchant settlement APIs and rapid weaponisation of newly disclosed file-upload and deserialisation vulnerabilities in PHP and Node.js applications that lead to web shells.
• Theft of cryptocurrency wallet keys.

A hallmark is the generation of large numbers of custom scripts that are functionally similar but rapidly refined in succession, behaviour consistent with AI-assisted development.

The Offensive AI Tooling Behind the Campaign

CERT-In attributes the activity to the use of publicly available AI-driven offensive security frameworks, including the ARTEX family of LLM-based tools, the PentAGI autonomous multi-agent penetration-testing system, the Cairn (also referred to as Caimi/CAIRN) attack search engine, and the CyberStrike.AI framework.

These tools can execute complete attack chains autonomously, generate and iterate payloads based on target responses, and operate at machine speed.

This is not an India-only phenomenon.

In late 2026, Google’s Threat Intelligence Group and Mandiant, CrowdStrike, Microsoft, Kaspersky and independent researchers documented the same or closely related agentic frameworks being abused worldwide.

China-nexus groups such as Vapor Panda (Earth Estries) and Storm-0940 used ARTEX against hundreds of organisations across government, defence, semiconductor, telecom and financial sectors in at least 14 countries, sometimes achieving privileged access in under three hours.

Separate financially motivated operators left Cairn control panels exposed, revealing more than 1,100 attack projects, many targeting e-commerce and payment infrastructure in the US, Japan and Australia, with individual successful intrusions estimated in some reports at roughly $50 in compute cost.

South Korean banks were among earlier victims of ARTEX-assisted activity.

The original ARTEX repository was taken down by its creator after widespread abuse, but forks and commercial variants continued circulating.

What distinguishes CRAFTY FALCON is the focused, repeated exploitation of financial disbursement and settlement APIs rather than pure espionage or broad data theft.

Once the attacker can invoke the victim’s own trusted payment interfaces, many traditional controls, KYC, sanctions screening, beneficiary verification, balance checks and per-transaction limits, are bypassed because the calls appear to originate from legitimate infrastructure.

Recommended Defences

CERT-In’s recommended actions reflect the machine-speed reality:

• Treat the campaign as active and ongoing; maintain heightened 24×7 monitoring with increased staffing and lowered alert thresholds during holidays and weekends.
• Assume persistence after any incident; perform full eradication with forensic verification and continue threat hunting. Incomplete remediation has already led to re-compromise.
• Enable real-time cloud audit log monitoring with alerts on remote command execution, serverless code changes, and creation of roles, users or access keys. Restrict cloud management and serverless execution to approved principals.
• Strictly isolate non-production environments from production, no shared credentials, tokens, databases or network paths, and apply production-grade hardening to any internet-facing test systems.
• Treat client applications as untrusted: enforce server-side validation of every business rule, implement request signing with nonces and timestamps, and use app attestation and certificate pinning.
• Replace shared-fetcher IP allow-lists with identity-based controls (mutual TLS, signed requests, scoped keys on dedicated endpoints).
• Flag micro-value test transactions to new beneficiaries followed by high-value transfers; implement velocity rules, new-beneficiary cooling periods and amount-band anomaly detection.
• Store cryptocurrency keys in hardware security modules or cold custody and require multi-signature approvals.
• Monitor for the download or execution of AI offensive frameworks and for LLM API traffic originating from non-development hosts.
• Deploy deception (honeypots, decoy panels, canary credentials) because autonomous agents enumerate exhaustively.
• Adopt zero-trust, micro-segmentation and inspection of east-west traffic on the assumption that the adversary is already inside.

Entities are instructed to report suspicious activity related to the campaign to CERT-In/CSIRT-Fin ([email protected]) and to the Indian Cybercrime Coordination Centre (I4C) via the Cyber Fraud Mitigation Centre portal for bulk fraudulent transactions.

The full indicators of compromise, infrastructure fingerprints and detection rules have been shared at restricted TLP levels; CERT-In emphasises that indicators rotate while techniques remain consistent.

Global Implications

CRAFTY FALCON illustrates a broader 2026 shift: open-source agentic offensive frameworks have compressed the kill chain from days to hours, lowered the skill barrier for sophisticated financial fraud, and made incomplete remediation especially dangerous because the attacker can re-scan and re-exploit at machine speed.

Financial institutions worldwide that rely on API-driven disbursement, payment aggregation or crypto custody face analogous risks.

Cloud misconfigurations, shared credentials between environments, and trust in client-side controls are no longer theoretical weaknesses, they are the precise conditions these tools are designed to find and chain together.

National CERTs, financial regulators and private threat intelligence teams are now documenting the same tooling in different geographies.

The defensive response required is correspondingly global: real-time cloud and API telemetry, identity-centric controls that do not rely on IP allow-lists, deception at scale, and operational models that assume autonomous agents are already enumerating the environment.

India’s CSIRT-Fin designation of CRAFTY FALCON is an early, concrete naming of a threat that is already demonstrating cross-border reach through shared offensive AI infrastructure.