Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

CERT-In Warns of Backdoored AI Tool in Crafty Falcon Attacks on Indian Finance

3 sources · 3 articlesFirst reported Updated ()
What's new

November 6: The Register reports escalation in attacks by CRAFTY FALCON timed to low-monitoring periods and advises improved logging and keeping test environments offline.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CERT-In discloses active AI-powered attacks by Crafty Falcon on Indian BFSI and crypto firms using backdoored ARTEX granting root access.

CERT-In has disclosed ongoing attacks by the AI-assisted actor Crafty Falcon targeting non-banking financial companies, fintech firms, payment providers, and cryptocurrency exchanges in India. The group leverages open-source tools such as ARTEX, which contains a backdoor in modified Docker images that grants root shell on unauthenticated access triggered by a CAPTCHA marker. Attackers steal API credentials, abuse payment APIs to transfer funds to mule accounts, erase logs, and tamper with security tools while operating during low-monitoring periods including weekends. Small test transfers of Rs. 1 often precede larger thefts, with the actor moving from exposed non-production systems into production.

Key facts
  • Backdoored ARTEX Docker image grants root access
  • 9,000 downloads of modified ARTEX image
  • Targets BFSI, fintech, crypto exchanges in India
  • Tools: ARTEX, Cairn, CyberStrikeAI
  • Attacks test Rs. 1 transfers before larger ones
  • CERT-In advisory published November 4, 2026
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 4, 2026CERT-In publishes advisory on Crafty Falcon AI attacks · Infosecurity Magazine
  2. Nov 5, 2026The Hacker News reports backdoored ARTEX exposing consoles to root · The Hacker News
  3. Nov 5, 2026Infosecurity Magazine reports India warns of AI-driven attacks · Infosecurity Magazine
  4. Nov 6, 2026The Register reports threat actor targets Indian fintechs on weekends · The Register

What each outlet adds

beyond the shared facts
  • The Hacker NewsDetails backdoored ARTEX Docker image and 9,000 downloads granting root access
  • Infosecurity MagazineAttack patterns, use of AWS Systems Manager, October prior warnings
  • The RegisterEscalation and weekend timing of attacks by CRAFTY FALCON
Vendors
CERT-INDockerMicrosoft
Products
ARTEX
Threat actors
Crafty FalconCRAFTY FALCON
Malware
ARTEXCyberStrikeAICairn
Victims
Indian fintechsdigital lending platformspayment service providerswallet operatorsBFSI organizationscryptocurrency exchanges
Organizations
CERT-InCERT-Fin
Countries
India

Coverage

oldest first · one row per article · UTC
  1. · 4d ago The Hacker NewsFirst report

    CERT-In Flags AI-Driven Attacks Using Backdoored ARTEX Image

    CERT-In discloses active attacks by the Crafty Falcon gang targeting India's BFSI sector and crypto firms with AI tools like ARTEX, while a modified Docker image for the tool grants root shell on every unauthenticated…

  2. · 4d ago Infosecurity Magazine

    CERT-In warns Crafty Falcon is hitting Indian fintech and crypto firms

    The actor moves from exposed non-production systems into production, then tests Rs. 1 transfers before larger thefts.

  3. · 3d ago The Register · Security

    CRAFTY FALCON targets Indian fintechs on weekends

    CERT-IN names actor CRAFTY FALCON and warns of active AI-powered attacks timed to low-monitoring periods.