CERT-In says CRAFTY FALCON is hitting Indian fintech payment APIs
Original title: CERT-In’s CRAFTY FALCON Advisory: AI Is the Accelerant, Your Payment APIs Are the Target
Remediated firms were attacked again on holidays, and CERT-In has not named the actor or victim count.
CERT-In’s CSIRT-Fin says the active CRAFTY FALCON campaign is stealing money from Indian NBFCs, lenders, payment firms and crypto exchanges by calling their own payment and disbursement APIs. Attackers enter through exposed staging systems, hardcoded tokens and public file-upload or deserialization flaws, then reuse shared credentials to reach production, including via AWS Systems Manager and Lambda. Transfers start with a Rs 1 test and move to mule accounts; logs are tampered with. Entities that patched after an October warning were targeted again.
Unconfirmed: CERT-In has not attributed CRAFTY FALCON or disclosed how many entities were hit; a China link is only a media report.
- CSIRT-Fin updated an October 9 warning in advisory CIAD-2026-0058.
- Named tools include ARTEX, PentAGI, Cairn and CyberStrikeAI.
- Allow-listed fetcher traffic bypasses KYC, balance and limit checks.
- A Rs 1 transfer tests the route before larger mule-account payments.
- Badbyte said a backdoored ARTEX image reached 62 consoles, unlinked to this actor.
Impact: Fraudulent payouts via payment APIs and stolen crypto wallet keys
- 1.Separate non-production from production credentials, keys, databases and routes.
- 2.Replace client and IP trust with signed requests, attestation or mutual TLS.
- 3.Rotate long-lived tokens and alert on AWS Systems Manager and Lambda changes.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1552.001 Credentials In FilesT1078 Valid AccountsT1651 Cloud Administration CommandT1562.001 Disable or Modify Tools
- Threat actors
- CRAFTY FALCON
- Countries
- India
From the original article
4 min read at cyble.com
CERT-In's critical advisory, last week, gives a name to the campaign draining Indian fintechs: CRAFTY FALCON, an "AI-assisted financial threat actor" that moves money by calling its victims' own payment and disbursement APIs. Organizations that fixed their systems after CERT-In's first warning in October have been hit again. The AI label will get the headlines.
By Mihir Bagwe · cyble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.