📰 Key Takeaways

India’s national cybersecurity agency CERT-In issued an updated warning on Wednesday, naming an AI-assisted threat actor “CRAFTY FALCON”, a campaign it first flagged back in October. This update is the first to explicitly list crypto exchanges among the victims, and it details the AI tools the attackers use. CERT-In says the threat is ongoing, with successful attacks still being reported even at non-banking financial companies (NBFCs) and fintechs that had received the earlier restricted advisory and hardened their systems.

CERT-In describes the actor as using machine intelligence to scout targets and operating at “machine speed,” going straight for the victims’ own payment and disbursement APIs. Victims include non-bank lenders, digital lending platforms, fintech companies, payment aggregators and service providers, and crypto exchanges. The attackers exploit vulnerable applications and exposed test environments, then use shared credentials and access tokens to move into production, with cloud infrastructure as the main target for dropping malicious files. AI tools help them quickly generate and tweak attack scripts, and they’ve also been used to reverse-engineer application source code to build tailored exploits. Some attacks were deliberately timed for weekends and holidays to delay detection. In some incidents, the attackers first ran small test transactions to confirm unauthorized transfers would work, then moved larger amounts. CERT-In also mentioned stolen crypto wallet keys and drained wallet funds, but it didn’t name the affected exchanges or disclose the amounts lost.

CERT-In urges organizations to treat this campaign as an escalating, ongoing threat: step up monitoring around the clock, and add staff and lower alert thresholds during low-coverage windows like holidays and weekends. Separately, it was reported that in October CrowdStrike said an attacker had used ARTEX, the same AI penetration-testing tool named in the advisory, together with AI models like Claude Code to breach South Korean financial firms and steal data.

💬 JudyAI Lab Take

CERT-In has named an AI-assisted threat actor “CRAFTY FALCON” and, for the first time, put crypto exchanges on the victim list. This incident shows that AI has gone from an attacker’s helper tool to a link in the attack chain that operates at “machine speed.”

A few details from the original report are worth AI builders’ attention. The attackers used AI to quickly generate and adjust attack scripts, and even reverse-engineered application source code to tailor their exploits. Their way in was exposed test environments plus shared credentials and access tokens, which let them walk straight into production. In other words, AI amplifies the speed of the attack, but what actually gets exploited is still the most basic design oversight. Another design lesson: the attackers called the victims’ own payment and disbursement APIs directly, ran small test transactions first to confirm it would work, then moved larger sums, and deliberately picked weekends and holidays to strike. It’s a reminder that an API isn’t just a feature entry point, it’s an attack surface that needs monitoring, and your defensive coverage can’t have gaps in time.

Take ten minutes today to check: are your test environments exposed to the internet, do test and production share the same credentials or tokens, and do you have alerts set up for small anomalous transactions?

📅 Source Info

🔗 Further Reading