India Warns of New AI-Driven Cyber-Attacks Targeting Financial Sector
In a new security advisory published on November 4, the Indian Computer Emergency Response Team (CERT-In) warned that non-banking financial companies, including digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges, have reported falling victim to repeated cyber-attacks.
In a new security advisory published on November 4, the Indian Computer Emergency Response Team (CERT-In) warned that non-banking financial companies, including digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges, have reported falling victim to repeated cyber-attacks.
Some of them received a restricted-distribution advisory in early October warning them of cyber threat actors exploiting application programmable interfaces (APIs) traditionally used for payment and disbursement transactions to make unauthorized transfers.
Despite undertaking remediation after receiving this previous warning, these financial organizations were attacked again, with CERT-In noting incomplete remediation on their part.
Attacks were typically observed during holiday periods, on weekends and other low-monitoring windows to delay detection and response, CERT-In added.
CERT-In noted that Crafty Flacon also exploits newly published vulnerabilities as soon as they become publicly available.
According to CERT-In’s Finance branch (CERT-Fin), Crafty Falcon is a previously undocumented threat actor that uses a range of AI and agentic AI penetration testing tools to breach the systems of its victims.
Typically, Crafty Falcon gains initial access through internet-exposed non-production environments, such as user acceptance testing (UAT), staging and testing environments.
The actor also bypasses IP allow-listing restrictions by routing traffic through whitelisted third-party fetcher IP pools, such as content-acceleration services and app-store review fetchers.
These shared services can be instructed by any internet user to fetch arbitrary URLs, allowing the actor to originate traffic from IP addresses already trusted by the organization.
Once inside, the threat actor moves from non-production environments into production systems by exploiting shared credentials, authentication tokens or network paths between the environments.
The actor reverse-engineers the organization's application codebases to develop tailored exploits.
They then use altered or modified application packages to initiate unauthorized API calls, bypassing security controls that assume only the legitimate client application will communicate with the APIs.
Cloud management services, such as AWS Systems Manager and Lambda, are abused to execute commands and deploy malicious files, allowing malicious activity to blend into legitimate cloud management operations.
These include file-upload and deserialization exploit chains, leading to the deployment of web shells in PHP and Node.js applications.
What happened
In a new security advisory published on November 4, the Indian Computer Emergency Response Team (CERT-In) warned that non-banking financial companies, including digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges, have reported falling victim to repeated cyber-attacks.
Some of them received a restricted-distribution advisory in early October warning them of cyber threat actors exploiting application programmable interfaces (APIs) traditionally used for payment and disbursement transactions to make unauthorized transfers.
Despite undertaking remediation after receiving this previous warning, these financial organizations were attacked again, with CERT-In noting incomplete remediation on their part.
What changed
Attacks were typically observed during holiday periods, on weekends and other low-monitoring windows to delay detection and response, CERT-In added.
CERT-In noted that Crafty Flacon also exploits newly published vulnerabilities as soon as they become publicly available.
Who is affected
According to CERT-In’s Finance branch (CERT-Fin), Crafty Falcon is a previously undocumented threat actor that uses a range of AI and agentic AI penetration testing tools to breach the systems of its victims.
Typically, Crafty Falcon gains initial access through internet-exposed non-production environments, such as user acceptance testing (UAT), staging and testing environments.
Why it matters
The actor also bypasses IP allow-listing restrictions by routing traffic through whitelisted third-party fetcher IP pools, such as content-acceleration services and app-store review fetchers.
These shared services can be instructed by any internet user to fetch arbitrary URLs, allowing the actor to originate traffic from IP addresses already trusted by the organization.
Technical details
Once inside, the threat actor moves from non-production environments into production systems by exploiting shared credentials, authentication tokens or network paths between the environments.
The actor reverse-engineers the organization's application codebases to develop tailored exploits.
They then use altered or modified application packages to initiate unauthorized API calls, bypassing security controls that assume only the legitimate client application will communicate with the APIs.
Response
Cloud management services, such as AWS Systems Manager and Lambda, are abused to execute commands and deploy malicious files, allowing malicious activity to blend into legitimate cloud management operations.
These include file-upload and deserialization exploit chains, leading to the deployment of web shells in PHP and Node.js applications.
What security teams should do
Read now: Chinese State Actor Used AI to Compromise ConnectWise Tenants In its latest advisory, CERT-In provided a long list of recommended security measures organizations can take to mitigate the threat.
These include: The agency also urged organizations to report any suspicious activity that could be related to Crafty Falcon to incident@cert-in.org.in with all relevant logs and to contact the Indian Cybercrime Coordination Centre (I4C) and its Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS).
Attribution
Infosecurity Magazine: In a new security advisory published on November 4, the Indian Computer Emergency Response Team (CERT-In) warned that non-banking financial companies, including digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges, have reported falling victim to repeated cyber-attacks.
Infosecurity Magazine: On November 3, French investigative weekly newspaper Le Canard enchaîné reported a new wave of attacks targeting refrigeration systems in France.
Infosecurity Magazine: BTCPay Server said in an incident update on November 2 that the thefts hit servers running version 2.4.1 or earlier of the open-source payment platform, and that attackers had used a different method to exploit a vulnerability fixed in version 2.4.2, released on August 7.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.