CERT-IN has named the attacker and told India’s lenders they are being re-targeted after their own remediation work failed.
The agency calls the crew CRAFTY FALCON and describes it as an AI-assisted financial threat actor. In October it warned digital lending platforms, fintech firms, payment service providers and wallet operators about targeting of internet-facing applications, exposed APIs and privileged endpoints. Thursday’s update reported continued success.
Breach, patch, breach again
The detail that should worry defenders is not the initial access. It is the follow-up. CERT-IN said previously compromised entities were deliberately attacked a second time after incomplete remediation, and that intrusions were scheduled around holidays, weekends and other low-monitoring periods to delay detection and response.
That pattern makes a form on a holiday the wrong time to declare an incident closed and a Tuesday the right time to verify it.
The toolkit points at a familiar cohort
The crew runs AI-enhanced tooling: the ARTEX penetration-testing agent, the Cairn attack search engine and the CyberStrikeAI framework. All three have been linked to users who appear to speak Chinese. ARTEX is the same instrument Microsoft and others have flagged for scanning public GitHub repositories for exposed secrets and then acting on what it finds.
CRAFTY FALCON’s entry point is quiet. It hunts development and testing environments left reachable, where it finds shared credentials, tokens or internal network paths, then walks into production.
What financial CISOs should do
Inventory every internet-facing dev and staging environment and ask what they inherit from production. Rotate any credential shared between the two. Move privileged and payment endpoints off the public internet. Then schedule the post-remediation verification for a normal business day, with a second signature, instead of closing at the end of an incident window.
