India Cyber Agency Warns of AI Hacking Group Targeting Financial Sector

India's cybersecurity agency, CERT-In, has issued an advisory warning of an ongoing campaign by a hacking group it calls Crafty Falcon. The group has launched artificial intelligence-driven cyberattacks against cryptocurrency exchanges, fintech companies, and non-bank lenders.

According to the agency, the hackers utilize automated AI software to execute intrusions at machine speed. CERT-In highlighted four specific tools involved in the campaign: ARTEX, PentAGI, Cairn, and CyberStrikeAI. Security researchers have connected at least two of these tools to China, including ARTEX, which was previously used in espionage and banking attacks in South Korea and other nations.

The agency explained that Crafty Falcon uses machine intelligence to reconnaissance targets and manipulates victims' internal payment interfaces to transfer funds. Cybercriminals scheduled these intrusions during holidays and weekends to avoid quick detection, occasionally re-attacking organizations that had only partially patched earlier vulnerabilities.

While CERT-In did not directly blame a specific state or specify financial losses, the warning follows several recent cybersecurity incidents across Indian lenders. Recent events include unauthorized transfers impacting ICICI Bank accounts, a dark-web leak of customer records at State Bank of India, and separate security breaches reported by Spandana Sphoorty Financial and AU Small Finance Bank.