In a critical advisory issued on Wednesday, India’s cybersecurity agency, CERT-In, has warned that hackers are targeting India’s finance sector with the help of AI tools. The group, designated as “Crafty Falcon,” operates at “machine speed” and strikes by exploiting a victim’s own payment systems to make unauthorised fund transfers.CERT-In said the campaign remains active and was affecting various players in the sector, including non-banking financial companies, digital lending platforms, fintech firms, payment aggregators, payment service providers, cryptocurrency exchanges and virtual digital asset service providers.“The threat is active and ongoing.

CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation,” the advisory said. CSIRT-Fin operates under CERT-In and focusses on the finance sector.As per the advisory, some organisations were attacked again after they failed to fix the flaws that initially exposed them.

The hacker group is also timing its attacks on holidays or weekends, when cybersecurity monitoring is lower. However, CERT-In has not named any organisation in particular that had faced an attack from the group.

Neither has the agency given any information on the potential financial impact these attacks have had till now.AI to hack finance sector, Re 1 test transactionsCERT-In stated that the group is using multiple publicly available AI-driven offensive security systems, including ARTEX, PentAGI, Cairn and CyberStrikeAI. According to the agency, these tools can execute complete attack chains autonomously.

These tools can execute the attack and make any changes based on the response from the targeted system. The supporting infrastructure also rotates IP addresses within hours or days, making it harder for companies to block the attackers.

The advisory added that the campaign has targeted cloud infrastructure and management systems such as AWS Systems Manager and Lambda. The group is then able to deploy malicious files into these channels.CERT-In explained that in some cases, the group reverse-engineered application code to create tailored exploits and modified application packages to make unauthorised API calls.

Hackers also first conducted small transactions, including transfers of Re 1 to test unauthorised fund flows before attempting larger transfers. Merchant settlement APIs were also exploited.

Meanwhile, cryptocurrency platforms were targeted for wallet keys.The group is said to be using environments that are exposed to the internet as entry points, such as testing and staging. Once in, they then move to production systems through shared credentials, tokens or network paths.

They also exploited the recently-disclosed flaws in PHP and NodeJS.CERT-In advises sector to increase monitoringAs the threat remains active, CERT-In has advised financial institutions to maintain round-the-clock monitoring, and increase staffing. It has also called for stronger controls over systems including cloud management tools and internet-facing environments.In addition, the agency recommended monitoring Rs 1 and other micro-value transfers followed by high-value payments, and introducing cooling periods for new beneficiaries.Organisations were also asked to monitor unauthorised AI security tools and large language model API use, and assume that attackers may already be inside their networks.The warning comes shortly after CERT-In disclosed that rogue AI agents had managed to breach select Indian organisations and gain unauthorised access to systems.

We have also seen cases where hackers have managed to obtain sensitive information from Indian banks, including the State Bank of India (SBI) and AU Small Finance Bank.Though CERT-In is reportedly beefing up its cybersecurity measures. The agency has reportedly gained access to Anthropic’s frontier cybersecurity model, Claude Mythos.At the same time, cybersecurity cases have risen globally.

Vulnerabilities in PHP, NodeJS, and weak eMudhra security keys had put the whole internet on alert last month, in what is now being called, “Black October.”- Ends