New Cyber Threat Actor Targets Financial Companies with AI-Powered Attacks
Recently, the financial sector has found itself under siege from a newly identified cyber threat actor known as ‘Crafty Falcon’. This entity leverages artificial intelligence (AI) and agentic AI tools, some of which have connections to previously documented Chinese hacking groups, marking a troubling evolution in cybersecurity threats.
On November 4, the Indian Computer Emergency Response Team (CERT-In) issued a security advisory indicating that various non-banking financial companies—including digital lending platforms, fintech firms, payment aggregators, payment service providers, and cryptocurrency exchanges—have become regular targets in a series of sophisticated cyber-attacks. These attacks have been particularly alarming given their frequency, with many organizations reporting multiple incidents.
In early October, some firms received restricted-distribution advisories warning them of potential threats involving cyber actors exploiting application programmable interfaces (APIs). These APIs are traditionally used for legitimate payment and disbursement transactions, and attackers sought to utilize them for unauthorized transfers. Despite these forewarnings and subsequent remediation efforts by the affected organizations, the attacks continued, suggesting that there were lapses in their security measures, which CERT-In described as “incomplete remediation.”
The observed cyber assaults typically coincide with holiday periods, weekends, or other times of low monitoring activity. This strategic timing appears designed to minimize the chances of detection and subsequent response from the victimized organizations.
Crafty Falcon’s Intricate Attack Methodology
CERT-In’s Finance branch (CERT-Fin) has classified Crafty Falcon as a previously undocumented threat actor that deploys a range of AI-driven penetration testing tools to infiltrate the systems of its targets. Initial access is often secured through internet-exposed non-production environments, such as user acceptance testing (UAT), staging, and testing systems.
Once Crafty Falcon secures entry, the actor navigates through the victim’s systems by taking advantage of shared credentials, authentication tokens, or network pathways connecting non-production environments to production systems. The actor also reverse-engineers the organization’s application codebases to create tailored exploits, utilizing modified application packages to initiate unauthorized API calls while evading security controls that generally trust legitimate client applications.
In an audacious tactic, the actor bypasses IP allow-listing restrictions by routing traffic through third-party IP pools that are already trusted by the organization. This includes content-acceleration services and app-store review fetchers, demonstrating a high level of sophistication and planning.
Additionally, Crafty Falcon targets cloud infrastructures, exploiting cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy potentially malicious files. This blend of malicious activity into legitimate cloud operations complicates detection efforts.
Before executing significant fund transfers, the actor conducts small-value test transactions—often just Rs. 1—to validate whether unauthorized fund flows can be executed. They specifically target APIs belonging to payment aggregators to facilitate these illicit transactions and extend their reach to cryptocurrency exchanges, where they can steal wallet keys and siphon off funds.
CERT-In identified that Crafty Falcon quickly exploits newly disclosed vulnerabilities, including file-upload and deserialization exploit chains, often leading to the deployment of malicious web shells in PHP and Node.js applications. The regular creation of custom, tailored scripts reflects their reliance on advanced AI capabilities, capable of generating and refining numerous variants of attack code.
Recommended Security Mitigations by CERT-In
In light of these alarming developments, CERT-In has provided a comprehensive list of recommendations aimed at enhancing security measures for organizations susceptible to these types of attacks. Key recommendations include maintaining 24/7 security monitoring, particularly during critical periods, and centralizing real-time auditing of cloud logs to alert on high-risk events.
Organizations are advised to restrict cloud management and serverless execution to verified principals and accounts, ensuring that UAT, staging, and testing environments are entirely separated from production environments. Furthermore, application deployment directories should be made read-only for runtime users, supplemented by strict file-integrity monitoring to detect unauthorized intrusions.
The advisory emphasizes treating all client applications and packages as untrusted until validated through server-side transaction checks, API request signing with nonces and timestamps, and application attestation techniques. Rapid patching service level agreements (SLAs) should also be established for internet-facing applications to address vulnerabilities quickly, particularly those that could facilitate unauthorized uploads or deserialization attacks.
Moreover, CERT-In encourages organizations to adopt zero-trust principles and micro-segmentation strategies to minimize risks associated with unauthorized access. The importance of vigilant monitoring and governing any AI tools used in a corporate environment cannot be overstated, as LLM API traffic from non-development hosts may signal a potential attack infrastructure.
Organizations experiencing suspicious activity potentially linked to Crafty Falcon are urged to report it to CERT-In and the Indian Cybercrime Coordination Centre, taking necessary precautions to safeguard sensitive information and mitigate risks effectively. The rise of advanced cyber threats underscores the critical need for heightened vigilance and robust security protocols among financial institutions.