India’s cybersecurity agency CERT-In has identified a hacking group called Crafty Falcon and four artificial intelligence (AI) tools allegedly used in cyberattacks targeting financial institutions. At least two of the tools have been linked to China by security researchers. The warning comes amid a rise in cyber incidents involving Indian banks, non-banking financial companies (NBFCs) and fintech firms.
The Indian Computer Emergency Response Team (CERT-In) issued an advisory on Wednesday, November 4, identifying the group behind a series of AI-driven attacks on financial organisations. The agency said the group had targeted non-bank lenders, fintech companies and cryptocurrency exchanges.
The development has raised concerns about the growing use of artificial intelligence in cybercrime and the security of India’s financial systems.
CERT-In Identifies Four AI Hacking Tools
According to the cybersecurity advisory, the hacking group, named Crafty Falcon, has been using four tools: ARTex, PentAGI, Cairn and CyberStrikeAI.
Security researchers have linked at least two of these tools to China. One of them, ARTex, is reported to be China-made and has previously been associated with cyberattacks targeting South Korean banks.
Cybersecurity firm CrowdStrike has said that ARTex was used in attacks against South Korean financial institutions from late September. The tool was also reportedly used by a China-linked group in an espionage campaign targeting more than 200 organisations across at least 14 countries.
However, CERT-In did not identify the individuals behind Crafty Falcon or establish that the attacks were sponsored by any government. The agency also noted that the tools it identified had been freely available online.
ARTex was reportedly made private by its developer last month after it was linked to the attacks on South Korean banks.
How Crafty Falcon Uses AI to Target Financial Companies
CERT-In said Crafty Falcon studies its targets using machine intelligence before attempting to exploit weaknesses in their systems.
The group reportedly uses the payment and disbursement systems of targeted organisations to move money. These systems are normally used by financial institutions to process transactions and send loan disbursements.
The attackers allegedly exploit these payment systems to carry out unauthorised financial activities. According to the advisory, AI tools allow them to automate cyber intrusions at high speed.
CERT-In described the threat as active and ongoing, warning that the use of publicly available AI tools has made it easier for attackers to carry out operations quickly.
The agency also highlighted the timing of these attacks. Hackers reportedly target holidays, weekends and other periods when security monitoring may be reduced. This can delay the detection of suspicious activities and give attackers more time to operate.
Some financial companies that had previously fixed security weaknesses were reportedly targeted again after their corrective measures proved incomplete.
Indian Banks Report Cybersecurity Incidents
The warning comes at a time when several Indian financial institutions have reported cybersecurity concerns.
State Bank of India (SBI), the country’s largest lender, disclosed a leak involving customer records last month.
Non-banking financial company Spandana Sphoorty Financial reported unauthorised debits from an account on November 1. AU Small Finance Bank also said it was investigating a possible customer-data leak.
In another incident, two Mumbai-based non-bank lenders reportedly lost around $2 million through more than 700 unauthorised instant transfers from accounts held with ICICI Bank on October 8 and 9. The information was based on a police complaint cited in earlier reporting.
These incidents have increased concerns about the safety of digital banking systems and the protection of customer information.
RBI Tightens Cybersecurity Monitoring
The latest warning comes as the Reserve Bank of India (RBI) has tightened cybersecurity checks following recent incidents involving financial institutions.
CERT-In did not disclose the names of all companies affected by the Crafty Falcon campaign or reveal how much money may have been stolen through the attacks. It also did not specify which reported incidents were directly connected to the hacking group.
The agency did not immediately identify who was operating Crafty Falcon or where the group was based.
The growing threat highlights the challenges financial institutions face as they increasingly depend on digital payment systems, online lending platforms and automated services.
With AI tools making cyberattacks faster and easier to automate, banks and financial companies will need stronger security systems, regular monitoring and quick responses to suspicious activities to protect customer data and financial transactions.
