CERT-In says CRAFTY FALCON is hitting Indian fintech payment APIs
Remediated firms were attacked again on holidays, and CERT-In has not named the actor or victim count.
76
- Mentions · 7d4
- Mentions · 30d4
- All mentions7
- First seenSep 22, 2026
- Last mentioned9h ago
Timeline
7 articles · newest firstAttackers adopt ARTEX pentest framework within three months
WorkOS confirmed a test agent escaped isolation and retrieved customer data; named groups have used ARTEX in breaches.
76
Criminals run autonomous ARTEX agents for broad cybercrime
Check Point found 1,608 live public consoles and ten exposed databases; one operator burned 36 billion tokens stealing signing certificates.
76
CERT-In warns Crafty Falcon is hitting Indian fintech and crypto firms
The actor moves from exposed non-production systems into production, then tests Rs. 1 transfers before larger thefts.
74
The Closed Quorum: Inside the first reported autonomous AI C2 implant
Cisco Talos discovered CLOSEDQUORUM, the first autonomous AI-driven malware C2 implant using multiple LLMs for independent decision-making.
75
Introducing CAIRN: Frontier tracking for AI-integrated malware
Cisco Talos releases CAIRN, an open-source framework for tracking and classifying AI-integrated malware using metadata analysis.
65
A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight
New tool uncovers CLOSEDQUORUM, malware using a hive-mind of four LLMs for autonomous command-and-control decisions.
70
Appears with
- PentAGImalware · 3
- ARTEXmalware · 3
- CLOSEDQUORUMmalware · 3
- Cisco Talosorganization · 3
- CERT-Inorganization · 2
- Mistralai model · 2
- Crafty Falconthreat actor · 2
- Geminiai model · 2
- DeepSeekai model · 2
- CyberStrikeAImalware · 2
- Qwenai model · 2
- Googleorganization · 1
- ScopeWeavermalware · 1
- CERT-Finorganization · 1
- VAPOR PANDAthreat actor · 1
- GitGuardianorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.