Financial companies are being targeted in successive attacks by a newly identified cyber threat actor known as ‘Crafty Falcon’ using AI and agentic AI tools, including some previously attributed to Chinese hacking groups.
In a new security advisory published on November 4, the Indian Computer Emergency Response Team (CERT-In) warned that non-banking financial companies, including digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges, have reported falling victim to repeated cyber-attacks.
Some of them received a restricted-distribution advisory in early October warning them of cyber threat actors exploiting application programmable interfaces (APIs) traditionally used for payment and disbursement transactions to make unauthorized transfers.
Despite undertaking remediation after receiving this previous warning, these financial organizations were attacked again, with CERT-In noting “incomplete remediation” on their part.
Attacks were typically observed during holiday periods, on weekends and “other low-monitoring windows” to delay detection and response, CERT-In added.
Crafty Falcon’s Attack Lifecycle
According to CERT-In’s Finance branch (CERT-Fin), Crafty Falcon is a previously undocumented threat actor that uses a range of AI and agentic AI penetration testing tools to breach the systems of its victims.
Typically, Crafty Falcon gains initial access through internet-exposed non-production environments, such as user acceptance testing (UAT), staging and testing environments.
Once inside, the threat actor moves from non-production environments into production systems by exploiting shared credentials, authentication tokens or network paths between the environments.
The actor reverse-engineers the organization's application codebases to develop tailored exploits. They then use altered or modified application packages to initiate unauthorized API calls, bypassing security controls that assume only the legitimate client application will communicate with the APIs.
The actor also bypasses IP allow-listing restrictions by routing traffic through whitelisted third-party fetcher IP pools, such as content-acceleration services and app-store review fetchers. These shared services can be instructed by any internet user to fetch arbitrary URLs, allowing the actor to originate traffic from IP addresses already trusted by the organization.
Another Crafty Falcon characteristic move is to target the victim’s cloud infrastructure, including compute, serverless and management services. Cloud management services, such as AWS Systems Manager and Lambda, are abused to execute commands and deploy malicious files, allowing malicious activity to blend into legitimate cloud management operations.
Before executing large-value transfers, the actor performs micro-value test transactions, such as transactions of Rs. 1, to validate that unauthorized fund flows are possible. They exploit or abuse merchant settlement APIs belonging to payment aggregators to move funds.
The actor targets cryptocurrency exchanges and virtual digital asset service providers, stealing wallet keys and siphoning funds from cryptocurrency wallets.
CERT-In noted that Crafty Flacon also exploits newly published vulnerabilities as soon as they become publicly available. These include file-upload and deserialization exploit chains, leading to the deployment of web shells in PHP and Node.js applications.
Throughout these activities, Crafty Falcon creates large numbers of custom, tailored scripts on the fly. Functionally identical variants are refined in rapid succession, a pattern consistent with AI-generated code and iterative AI-assisted development.
Notably, CERT-In and CERT-Fin observed the use – and combination – of several AI-powered offensive security tools against affected entities. These include:
- Penetration testing tool ARTEX, based on PentAGI, an autonomous, multi-agent framework that can be plugged to large language models (LLMs)
- Penetration testing framework CyberStrikeAI
- Attack search engine Cairn
These tools allow attackers to “execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses,” CERT-IN indicated.
While these tools are publicly available and could be used by many threat actors, most previous malicious campaigns where they were deployed were linked to China-based actors.
Read now: Chinese State Actor Used AI to Compromise ConnectWise Tenants
CERT-In Provides Crafty Falcon Threat Mitigation Recommendations
In its latest advisory, CERT-In provided a long list of recommended security measures organizations can take to mitigate the threat. These include:
- Maintaining heightened 24/7 security monitoring, increased staffing and lower alert thresholds during holidays, weekends and periods of reduced monitoring
- Centralizing real-time monitoring of cloud audit logs and alert on high-risk events, including remote command execution, serverless function code updates and creation of roles, users or access keys
- Restricting cloud management and serverless execution to approved principals and accounts
- Implementing instance metadata service protections, least-privilege roles, restrictions on wildcard egress and default-deny internet egress for serverless functions
- Separating UAT, staging and testing environments from production, ensuring no shared credentials, tokens, API keys, databases or direct network paths
- Making application deployment directories read-only for application runtime users and implement file-integrity monitoring to detect web shells
- Treating client applications and packages as untrusted and enforcing server-side transaction validation, API request signing using nonces and timestamps, application attestation and certificate pinning
- Establish rapid patching SLAs for Internet-facing applications, prioritizing file-upload and deserialization vulnerabilities in PHP and Node.js. Use WAF virtual patching as an interim measure
- Extending real-time transaction monitoring to identify small-value test transactions to new beneficiaries followed by high-value transfers. Treat these as strong indicators of potentially unauthorized fund transfers and hold or review such transactions
- Storing cryptocurrency wallet keys in hardware security modules or cold custody
- Prohibiting unauthorized security and attack tools, including publicly available AI-driven offensive frameworks, on corporate infrastructure
- Monitoring and governing LLM API usage and keys. LLM API traffic originating from servers or non-development hosts may indicate an attack infrastructure or planted operator console
- Adjusting SIEM correlation to identify machine-speed, multi-technique attacks, parallel attack threads, adaptive payload changes and continuous activity outside business hours. Implement automated SOAR-based containment
- Adopting zero-trust principles, micro-segmentation, identity-based access controls for every user and service and inspection of east-west traffic
The agency also urged organizations to report any suspicious activity that could be related to Crafty Falcon to incident@cert-in.org.in with all relevant logs and to contact the Indian Cybercrime Coordination Centre (I4C) and its Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS).