MAG212 CYBER ORIGINAL ARTICLE

Crafty Falcon: CERT-In Warns of AI-Assisted Attacks on India’s Lenders, Fintechs and Payment Firms

November 5, 2026 · El Mostafa Ouchen

India’s national CERT has escalated its warning about attacks on lenders, fintechs and payment companies. Advisory CIAD-2026-0058, issued November 4 and rated Critical, ties the activity to a threat actor called “CRAFTY FALCON” and says the threat is “active and ongoing”. It also describes something new: AI-generated attack tooling that produces fresh script variants and rotates infrastructure faster than blocklists can keep up.

Key facts

Item	Detail
Advisory	CERT-In CIAD-2026-0058, November 4, 2026, severity Critical
Earlier warning	CIAD-2026-0046, October 9, 2026 (no actor named)
Actor name	“CRAFTY FALCON”, designated by CSIRT-Fin, the financial-sector CSIRT under CERT-In
Targets	NBFCs, digital lenders, fintechs, payment aggregators and PSPs, crypto exchanges and VDASPs
Tooling named	ARTEX LLM tools, PentAGI, Cairn, CyberStrikeAI
Victims	No count published; no CVE named

What CERT-In describes

The October 9 advisory warned that attackers were abusing payment and disbursement APIs to move money without authorization. The November 4 escalation goes further. It names the actor, and it describes many functionally identical script variants (consistent with AI-generated code), payloads that adapt to how the target responds, and IP addresses that rotate within hours to days.

A restricted version with full indicators of compromise went only to financial-sector entities. The public advisory gives no victim or loss figures. Press reports mentioning large AI-fraud losses cite a separate agency’s findings, not this advisory.

Crafty Falcon tradecraft as a composite path with selected CERT-In controls. It does not depict a single observed incident. MAG212 CYBER original diagram.

How the attacks work

Entry through internet-facing UAT, staging or test environments, including web shells planted via PHP or Node.js file-upload and deserialization bugs.
Pivot into production through shared credentials, tokens or network paths.
Cloud abuse of AWS Systems Manager and AWS Lambda.
Money movement through payment APIs and merchant-settlement APIs, starting with micro test transfers (the advisory’s example is Rs. 1) before larger ones.
Other tradecraft: reverse-engineered client apps, IP allow-list bypass through whitelisted third-party “fetcher” IP pools, crypto wallet key theft, and returning to firms that had already cleaned up, timed for holidays and weekends.

What to look for

Systems Manager SendCommand calls and Lambda function changes by principals that don’t normally make them, especially staging identities.
New beneficiaries followed by a tiny transfer and then a large one; settlement API activity on holidays and weekends.
New script files in upload or temp paths on staging servers; deserialization errors in app logs.
Any key, token or password that works in both staging and production.

Read-only CloudTrail checks with AWS CLI v2 (needs cloudtrail:LookupEvents; repeat per region):

aws cloudtrail lookup-events --region REGION --max-results 50 \
  --lookup-attributes AttributeKey=EventName,AttributeValue=SendCommand
aws cloudtrail lookup-events --region REGION --max-results 50 \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=lambda.amazonaws.com

Compare each caller and time with approved changes. Event history covers recent management events only; an empty result doesn’t clear other regions. Checked against AWS CLI documentation; not run against a live account.

Containment and fixes

With finance and payment partners, put a scoped hold on suspect payout routes and reconcile against the ledger.
Preserve CloudTrail, application and ledger records with request IDs and UTC timestamps.
Revoke suspect sessions and keys and remove unapproved roles or function changes. CERT-In advises assuming the attacker may still be present after an incident.
Isolate non-production from production, with no shared credentials. Restrict Systems Manager and Lambda to approved principals, and deny default outbound traffic from functions.
Add maker-checker approval for settlements, waiting periods for new beneficiaries, request signing and app attestation, and alerts on micro-then-large transfer patterns.
Ban unauthorized offensive AI tools inside your own estate, and govern LLM API keys.

A related warning: a backdoored ARTEX image

The Hacker News reported on November 5 that a Docker image of the ARTEX AI pentest tool (“tomicdd/artex”, about 9,000 pulls) was backdoored, with 62 exposed consoles serving the tampered build. No source links this to Crafty Falcon, and those console counts come from scans of the tool, not victims. Red teams should pin and verify offensive tooling images like any other dependency.

Frequently asked questions

Are banks targeted?

The advisory’s target list covers NBFCs, digital lenders, fintechs, payment aggregators and payment service providers, and crypto exchanges. It does not single out banks, though some press coverage says so.

Is there a CVE to patch?

No. This is a campaign that exploits weak separation between environments and weak transaction controls. Fast patching of PHP and Node.js flaws still matters, as CERT-In notes.

Who named the actor?

CSIRT-Fin, the financial-sector CSIRT operating under CERT-In.

Read today’s full MAG212 CYBER Daily (free) →

Subscribe free