CERT-In Warns of 'Crafty Falcon' AI-Driven Attacks on Indian Financial Sector
India's CERT-In issued an advisory on November 4 warning that non-banking financial companies—including digital lending platforms, fintech firms, payment aggregators and cryptocurrency exchanges—are being repeatedly targeted by a newly identified threat actor dubbed Crafty Falcon. Despite an earlier restricted-distribution advisory in October, affected organizations suffered repeat attacks due to incomplete remediation. Crafty Falcon uses AI and agentic AI penetration-testing tools to automate reconnaissance, exploit development and payload adaptation, with activity patterns consistent with those previously linked to China-based actors, though CERT-In stopped short of formal attribution.
Detalhes técnicos
Crafty Falcon gains initial access through internet-exposed non-production environments (UAT, staging, testing) and pivots to production systems via shared credentials, tokens or network paths. The actor reverse-engineers application codebases to craft tailored exploits, uses modified application packages to bypass client-trust assumptions in APIs, and evades IP allow-listing by routing traffic through trusted third-party fetcher pools (content-acceleration services, app-store review fetchers). It abuses cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files while blending into legitimate operations. Before large-value fraud, the actor performs micro-value test transactions (e.g., Rs. 1) and abuses merchant settlement APIs of payment aggregators; cryptocurrency exchanges are targeted for wallet-key theft. The group rapidly exploits newly disclosed file-upload and deserialization vulnerabilities to deploy PHP and Node.js web shells. Observed offensive AI tooling includes ARTEX (based on the PetAGI multi-agent LLM framework), CyberStrikeAI, and the attack search engine Cairn, enabling autonomous, machine-speed attack-chain execution and rapid script variant generation.
Remediação
CERT-In recommends 24/7 monitoring with lowered alert thresholds during low-activity periods, centralized cloud audit-log monitoring, restricting cloud/serverless execution to approved principals, strict separation of non-production and production environments, read-only deployment directories with file-integrity monitoring, server-side transaction validation with request signing and certificate pinning, rapid patching SLAs with WAF virtual patching for file-upload/deserialization flaws, enhanced transaction monitoring for micro-value test transfers, hardware security modules for crypto wallet keys, prohibition of unauthorized AI offensive tools, LLM API usage governance, SIEM tuning for machine-speed multi-technique attacks, and adoption of zero-trust and micro-segmentation principles. Organizations are urged to report incidents to [email protected] and India's Cybercrime Coordination Centre (I4C).
Linha do tempo
-
CERT-In Warns of 'Crafty Falcon' AI-Driven Attacks on Indian Financial Sector
ler a análise desta fonte ocultar
India's CERT-In issued an advisory on November 4 warning that non-banking financial companies—including digital lending platforms, fintech firms, payment aggregators and cryptocurrency exchanges—are being repeatedly targeted by a newly identified threat actor dubbed Crafty Falcon. Despite an earlier restricted-distribution advisory in October, affected organizations suffered repeat attacks due to incomplete remediation. Crafty Falcon uses AI and agentic AI penetration-testing tools to automate reconnaissance, exploit development and payload adaptation, with activity patterns consistent with those previously linked to China-based actors, though CERT-In stopped short of formal attribution.
Technical Details
Crafty Falcon gains initial access through internet-exposed non-production environments (UAT, staging, testing) and pivots to production systems via shared credentials, tokens or network paths. The actor reverse-engineers application codebases to craft tailored exploits, uses modified application packages to bypass client-trust assumptions in APIs, and evades IP allow-listing by routing traffic through trusted third-party fetcher pools (content-acceleration services, app-store review fetchers). It abuses cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files while blending into legitimate operations. Before large-value fraud, the actor performs micro-value test transactions (e.g., Rs. 1) and abuses merchant settlement APIs of payment aggregators; cryptocurrency exchanges are targeted for wallet-key theft. The group rapidly exploits newly disclosed file-upload and deserialization vulnerabilities to deploy PHP and Node.js web shells. Observed offensive AI tooling includes ARTEX (based on the PetAGI multi-agent LLM framework), CyberStrikeAI, and the attack search engine Cairn, enabling autonomous, machine-speed attack-chain execution and rapid script variant generation.
Remediation
CERT-In recommends 24/7 monitoring with lowered alert thresholds during low-activity periods, centralized cloud audit-log monitoring, restricting cloud/serverless execution to approved principals, strict separation of non-production and production environments, read-only deployment directories with file-integrity monitoring, server-side transaction validation with request signing and certificate pinning, rapid patching SLAs with WAF virtual patching for file-upload/deserialization flaws, enhanced transaction monitoring for micro-value test transfers, hardware security modules for crypto wallet keys, prohibition of unauthorized AI offensive tools, LLM API usage governance, SIEM tuning for machine-speed multi-technique attacks, and adoption of zero-trust and micro-segmentation principles. Organizations are urged to report incidents to [email protected] and India's Cybercrime Coordination Centre (I4C).