Threat actor targets Indian fintechs on weekends when defenders aren’t watching

What happened

CERT-IN first saw these attacks in October and issued an advisory. In a November update, it said attacks are still succeeding. Some victims were hit again after they tried to fix their systems. The attackers aim at internet-facing apps and payment systems, and they try to move money out. The agency says the group uses AI tools to help it attack.

Key facts

• CERT-IN first detected the attacks in October.
• The group was given the name CRAFTY FALCON by CERT-IN.
• Test payments of about $0.01 are used to check whether an attack works.
• Attacks are timed for holidays, weekends and other low-monitoring windows.
• Tools linked to the group include ARTEX, Cairn and CyberStrikeAI.

How the attacks work

The group first looks for test or development systems that are open to the internet. These often hold shared passwords, tokens or network paths. With these, it moves into live systems. Then it rewrites the victim's apps so they make unauthorized API calls. Because security tools expect those calls from real apps, the activity often goes unnoticed. For crypto exchanges, the group steals wallet keys and empties wallets.

Why it matters

Fintech firms handle money and personal data, so a successful attack can cause large losses. The attacks are fast-changing and use AI to make many small variations, which makes them harder to spot. Defenders need round-the-clock monitoring, better logs and alerts, and tighter control over test systems and cloud access.

What to watch

• Whether CERT-IN publishes more updates on CRAFTY FALCON.
• Whether more banks, insurers or payment firms report attacks.
• How fast companies close the gaps CERT-IN has named.
• Whether the group keeps exploiting newly found software flaws.