CRAFTY FALCON AI Campaign Prompts CERT-In Advisory for Fintech and Crypto Firms

CERT-In issued Critical Advisory CIAD-2026-0058 on 4 November 2026, naming threat actor CRAFTY FALCON for an active AI-assisted cyber campaign against Indian BFSI entities. The advisory updates an earlier notice from 9 October 2026 and directs immediate action by non-banking financial companies, digital lending platforms, payment service providers and cryptocurrency exchanges.

The campaign uses AI tools to scan targets rapidly and gain entry through exposed non-production environments and cloud services. Attackers then move laterally, modify application packages and invoke payment or disbursement APIs to transfer funds. Successful incidents have included small test transactions followed by larger unauthorized movements, with timing often aligned to weekends or holidays.

Attack Methods and AI Tools Identified by CERT-In

Entry points include internet-exposed UAT, staging and testing environments hosted on cloud infrastructure such as AWS Lambda. Attackers exploit shared credentials, bypass IP allow-listing through whitelisted third-party services and deploy web shells by exploiting recent PHP and Node.js vulnerabilities. Merchant settlement APIs and wallet key storage on crypto platforms have also been targeted.

The advisory lists several AI tools associated with the activity. The ARTEX family consists of LLM-based multi-agent platforms used for penetration testing and command-and-control. PentAGI provides autonomous multi-agent penetration testing, while Cairn functions as an attack search engine. The CyberStrikeAI framework supports full attack chains, script generation and payload adaptation. Reports link some of these tools to actors operating from China, though CERT-In focuses on observed techniques rather than attribution.

Campaign activity remains ongoing. Entities that received prior restricted advisories and completed remediation have still faced re-targeting when fixes were incomplete. CERT-In notes that small initial transfers, often around one rupee, precede larger movements and that mule accounts receive the proceeds.

Immediate Steps and Sector Response

CERT-In states the threat is active and ongoing and classifies it as an immediate and continuing risk to the BFSI sector. Recommended actions include 24x7 monitoring with increased staffing during low-coverage periods, full post-incident eradication combined with forensics and threat hunting, isolation of non-production environments and implementation of transaction controls such as cooling periods and velocity checks. Cloud logging, least-privilege access and regular review of exposed services are also required.

No victim names, incident counts or loss figures appear in the public advisory. Separate reporting has referenced October incidents involving entities including State Bank of India, AU Small Finance Bank and Spandana Sphoorty, along with one Mumbai NBFC case around two million dollars, though CERT-In has not linked these directly to CRAFTY FALCON. CSIRT-Fin continues to monitor the situation and may distribute additional indicators of compromise through restricted channels.

BFSI organizations should treat the advisory as a prompt to audit non-production environments, enforce strict API controls and verify that prior remediation steps fully address credential and logging gaps. Continued monitoring by sector teams remains essential as the campaign evolves.