India’s national cybersecurity agency has issued an urgent warning regarding an artificial intelligence-assisted threat actor actively targeting cryptocurrency exchanges and financial institutions. The Indian Computer Emergency Response Team (CERT-In) designated the campaign as CRAFTY FALCON, stating that the group operates at machine speed to breach systems and drain digital assets.
Active Campaign and Targeted Sectors
In an update to advisories first released in October, CERT-In confirmed that the threat remains active and escalating. The agency reported receiving accounts of successful attacks from nonbank financial companies (NBFCs) and fintech entities, including those that had previously implemented remediation measures following earlier warnings.
The campaign has cast a wide net across the financial technology sector. Targets include nonbank lenders, digital lending platforms, payment aggregators, service providers, and cryptocurrency exchanges. CERT-In did not identify specific affected exchanges or quantify the total financial losses incurred during these intrusions.
AI-Enhanced Attack Methods
CERT-In described the adversary as using machine intelligence to survey potential targets and execute strikes by invoking the victims' own payment and disbursement APIs. This approach allows attackers to bypass traditional perimeter defenses by leveraging legitimate system functions.
The agency detailed how AI tools facilitate the rapid generation and refinement of attack scripts. Attackers also reverse-engineer application code to develop tailored exploits. To maximize impact and delay detection, some operations are timed to occur during weekends and holidays when security staffing is typically reduced.
Initial access is often gained through vulnerable applications and exposed testing environments. Once inside, the threat actors utilize shared credentials and access tokens to move laterally into production systems. CERT-In confirmed that these intrusions have resulted in stolen cryptocurrency wallet keys and drained funds.
Global Context and Advisory
The tactics align with broader trends observed in the region. In October, cybersecurity firm CrowdStrike reported that an unidentified attacker used ARTEX, an AI penetration-testing tool also cited in CERT-In’s advisory, alongside Claude Code and other AI models to breach South Korean financial firms and steal data.
CERT-In has advised all at-risk entities to treat the CRAFTY FALCON campaign as an immediate and growing danger. The agency urged companies to heighten security monitoring around the clock, specifically recommending increased staffing and lowered alert thresholds during low-coverage windows such as holidays and weekends.
