Malware Attack on NBFC Server Drains ₹3.93 Crore in 149 Transfers; Delhi Police Trace Crypto Trail

NEW DELHI, Oct 27 – Hackers who planted malware on a server of an Indian non-banking finance company (NBFC) drained about ₹3.93 crore from the bank account it used to disburse loans, firing off 149 transfers in a single morning, Delhi Police said.

The money was then moved through mule accounts, converted into the cryptocurrency USDT and sent abroad.

"A few days ago, a server of an NBFC company was attacked.

Following a malware infection, approximately ₹3.93 crore was siphoned off from the bank through which the company disbursed loans and transferred through multiple layers of different accounts," Sanjay Bhatia, Additional Commissioner of the Delhi Police Special Cell's Intelligence Fusion and Strategic Operations (IFSO) unit, said in a video statement.

Police have not named the NBFC or the malware family, or said how the attackers got onto the server.

Malware to money in hours

The attack hit at around 11 a.m. on Oct. 5, when 149 unauthorised debits worth ₹3,93,59,000 left the company's account at a private bank, police said.

Investigators described it as an unauthorised takeover of the account.

The speed and volume point to automation rather than manual fraud: once attackers control a server trusted by a bank, they can push payouts that look legitimate to the bank's systems.

That matches techniques flagged by India's Computer Emergency Response Team (CERT-In).

In a critical advisory on Oct. 9, CIAD-2026-0046, CERT-In and CSIRT-Fin said attackers were stealing payment-gateway and partner-bank API keys from NBFCs and fintechs, then calling disbursal APIs from the victims' own whitelisted servers.

That bypassed loan creation, KYC, sanction and beneficiary checks.

Fake reference numbers were used, funds moved over IMPS and NEFT to mule accounts, and logs were wiped.

A second advisory on Oct. 15, CIAD-2026-0049, warned of a financially motivated campaign using open-source agentic attack tools that cut the time from initial access to impact from days to hours.

Victims that only partly fixed the flaws were hit again within days, CERT-In said.

Police have not said whether the IFSO case is linked to either campaign.

Crypto exit

Asked whether hawala was involved, Bhatia said police had found USDT moving in and out of wallets linked to the suspects and were tracing those wallets' further links.

About ₹1.80 crore has been frozen, he said.

The alleged key accused, Brij Lal, 29, of Phalodi in Rajasthan, received the money through mule accounts, withdrew cash and bought USDT through a hawala operator, police said.

During questioning he allegedly said he held a wallet on a foreign money-exchange app called "U Home" and was in contact with a foreign network through a Hong Kong (+852) number.

Police said those claims were being verified.

Bhatia said eight people had been arrested.

Police and media accounts have named seven, all from Rajasthan: Lal; Piyush Talaniya, 19, Vipin Chanwariya, 19, Rakesh Bahadu, 26, and Hemant Singh, 23, of Bikaner; Sunil, 23, of Jodhpur; and Vikram, 23, of Phalodi.

Police recovered 45 cheque books, 25 passbooks, 45 ATM cards and 13 phones.

The arrests so far cover the cash-out network.

Police have not said whether anyone has been identified behind the server intrusion itself.

Same playbook, other victims

At least five other Indian lenders and payment firms have reported similar server or API breaches since August:

• Hero FinCorp, Delhi, ₹12.84 crore: 317 unauthorised debits to 34 mule accounts. Police suspect the NBFC's internal server was hacked and allege links to Chinese-run Telegram groups and a Dubai-based handler.
• Renova Paytech, Noida, about ₹2.42 crore (Sept. 13): sources say the server was hacked and 497 transactions went through its API portal to 58 accounts across 28 banks.
• VK Venture, Navi Mumbai, ₹1.98 crore (Oct. 2): sources say attackers breached the server and bypassed the payment gateway without valid credentials or OTP, making 57 transfers in 90 minutes.
• Vivifi India Finance, Hyderabad, about ₹3.34 crore (Oct. 19): sources say attackers got into the lender's systems and API and made 183 transfers in under 90 minutes.

Under Reserve Bank of India cybersecurity directions for NBFCs, lenders must report cyber incidents within six hours of detection.

Security experts advise replacing static API keys with short-lived credentials, isolating servers that hold banking credentials and monitoring payouts in real time.

Victims can call 1930 or file at cybercrime.gov.in.

Cybersecurity Recommendations for NBFC for API Security

• Inventory every API: auto-discover public, partner, internal, shadow APIs and tag owner + data type (PAN, Aadhaar, bank data)
• Kill dormant APIs: immediately deactivate deprecated, test, unused v1/v2 endpoints
• Remove admin interfaces from internet: no Swagger, management, debug endpoints public
• Put gateway in front: all APIs via API Gateway (Apigee/Kong/ AWS) - no direct backend exposure
• Enforce secure protocols: TLS 1.2+ everywhere, mTLS for B2B/partner calls
• No API keys for sensitive data: use OAuth 2.0 + OIDC + short-lived JWTs, FAPI profile for financial flows
• Partner auth with mTLS: client credentials grant per partner, separate client_id, scope, IP allowlist
• Fix BOLA: check object ownership on every request - user can only access his own loan_id/customer_id
• Fix BFLA: check function/role - customer cannot call admin/disbursal APIs
• Fix BOPLA: return only required fields, never full customer object
• Strict input validation: validate against OpenAPI schema, size, type, enum - reject JSON bombs
• Rate limit + throttling: per user, per partner, per IP (e.g. 5 KYC attempts/hour, 60 req/min)
• Detect automation: real-time monitoring for spikes, bulk extraction, suspicious registrations
• WAF + API firewall: block injection, SSRF, mass assignment
• Tokenize PII: never pass raw PAN/Aadhaar - use vault/token, mask in responses/logs
• No sensitive data in logs/errors: mask PAN, OTP, account numbers, JWTs
• Least privilege + MFA: enforce MFA for admin, least privilege for backend and cloud access
• Secrets management: store in Vault, rotate every 90 days, no secrets in code/Git
• Secure third-party consumption: validate external KYC/bureau APIs, timeouts, no blind redirects
• Board-approved policy + CISO: as mandated by RBI
• Quarterly scans + annual pentest: third-party VAPT for all external APIs
• Central logging + SIEM: log who/what/when/result for every API, alert on 403 spikes
• 6-hour breach reporting: report cyber incidents on RBI DAKSH + CERT-In within 6 hours
• Kill-switch: ability to instantly disable partner client_id if compromised