CERT-In warns Crafty Falcon is hitting Indian fintech and crypto firms
Original title: India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses
The actor moves from exposed non-production systems into production, then tests Rs. 1 transfers before larger thefts.
CERT-In said non-banking financial companies, fintech firms, payment providers, and cryptocurrency exchanges in India were hit again by a previously undocumented actor it calls Crafty Falcon. The advisory, published November 4, says some firms were warned in early October about API abuse for unauthorized transfers and were attacked again after incomplete remediation. Crafty Falcon enters internet-exposed UAT, staging, or test systems, pivots with shared credentials or tokens, and abuses payment and cloud management APIs.
Unconfirmed: CERT-In does not attribute Crafty Falcon itself to China; the China link applies to earlier use of the same tools.
- Attacks were often seen on holidays, weekends, and other low-monitoring windows.
- The actor routes through trusted third-party fetcher IP pools to bypass allow lists.
- AWS Systems Manager and Lambda are abused to run commands and plant files.
- CERT-In saw ARTEX, CyberStrikeAI, and Cairn used against affected entities.
- Prior malicious use of those public tools was mostly linked to China-based actors.
Impact: Unauthorized fund transfers and stolen cryptocurrency wallet keys
- 1.Keep 24/7 monitoring and lower alert thresholds on holidays and weekends.
- 2.Separate non-production from production with no shared credentials, tokens, or paths.
- 3.Make deployment directories read-only and monitor them for web shells.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1505.003 Web ShellT1059 Command and Scripting Interpreter
- Threat actors
- Crafty Falcon
- Malware
- ARTEXCyberStrikeAICairn
- Countries
- India
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| incident@cert-in.org.in | spicious activity that could be related to Crafty Falcon to incident@cert-in.org.in with all relevant logs and to contact the Indian Cybercrime |
From the original article
4 min read at infosecurity-magazine.com
The Indian CERT said a new cyber malicious group tracked as ‘Crafty Flacon’ is using Chinese-made AI tools to attack fintech and crypto organizations
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.