India’s cybersecurity agency has named the hacking group behind a wave of AI-driven attacks on financial firms, after independent cybersecurity researchers previously linked at least two of the tools used to China.
The Indian Computer Emergency Response Team (CERT-In) calls the group “Crafty Falcon,” and it has breached non-bank lenders, fintech firms, and cryptocurrency exchanges, according to an advisory issued on Wednesday.
“The threat is active and ongoing,” it said, adding that the severity rating was “critical.”
CERT-In did not say who was behind the breaches or where the organization operates.
It said that Crafty Falcon is an AI-assisted financial threat actor that operates at “machine speed and strikes.” It said the actor “surveys its targets with machine intelligence” and moves money by invoking victims’ own payment and disbursement systems.
It said that attacks have been timed to coincide with holidays, weekends, and other low-monitoring windows to delay detection and response.
India’s national agency for coordinating the fight against cybercrime warned that cyberattacks on banks, lenders, and other financial firms are being carried out with the help of artificial intelligence agents.
“These attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents, leading to machine-speed compromise,” the Indian Cybercrime Coordination Center (I4C) said in an advisory made public on Wednesday.
CERT-In named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. It did not name the affected companies or say how much money was stolen.
The agency said that these tools execute complete attack chains autonomously at “machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses.”
Some of the reported incidents include cryptocurrency exchanges and virtual digital asset service providers being targeted, with wallet keys stolen and funds siphoned from cryptocurrency wallets.
Independent security researchers have linked at least two of the tools to China, but CERT-In itself has not established that the hackers themselves are Chinese.
In an Oct. 7 post, Texas cybersecurity firm CrowdStrike said that ARTEX is a recently released “open-source agentic penetration testing (pentesting)” tool developed in China.
CrowdStrike Intelligence said it identified infrastructure linked to a targeted campaign against South Korean financial organizations that exfiltrated data from late September to early October this year.
It said that while it has not attributed this activity to a named adversary, the threat actor is “likely a Chinese speaker and financially motivated.”
“This assessment is made with moderate confidence based on the use of the Chinese-developed tool ARTEX and observed Chinese-language prompts,” it added.
CyberStrikeAI is an open-source AI offensive security tool (OST) developed by a China-based developer.
In a March post, Florida-based cybersecurity intelligence company Team Cymru assessed that it had some ties to the Chinese government.
Several lenders in India have faced cyberattacks in recent weeks.
State Bank of India (SBI), the country’s largest lender, disclosed a dark-web leak of 3,897 customer records last month, after CERT-In alerted it.
The hack exposed customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch details, and metadata associated with loan records.
CERT-In has not said that Crafty Falcon was responsible for the SBI leak.
AI models also recently broke into Indian organizations’ live systems during testing and read confidential records undetected.
AI model providers voluntarily disclosed that their agents “exceeded the authorization of their assigned tasks” during test runs to access Indian firms’ data, including business records, CERT-In said on Oct. 15.
Reuters contributed to this report.
