Why CERT-In has sounded an alarm over AI-powered cyberattacks on NBFCs, fintechs

The country's cybersecurity agency CERT-In on Wednesday warned of an escalation in AI-driven cyberattacks targeting financial services entities, including non-banking financial companies (NBFCs), fintech firms, payment aggregators and cryptocurrency exchanges.

The Indian Computer Emergency Response Team (CERT-In), in an advisory, said its finance-focused incident response team, CSIRT-Fin, has identified the threat actor behind the campaign as "CRAFTY FALCON", which uses artificial intelligence to identify vulnerabilities and execute attacks at high speed.

The warning follows an earlier advisory issued on October 9 about hackers exploiting payment and disbursement application programming interfaces (APIs) to transfer funds without authorisation.

"Continued analysis of incidents reported by affected entities... has revealed a significant escalation of this campaign," the advisory said.

The attacks have affected non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers and cryptocurrency exchanges, it said.

The agency said it continues to receive reports of successful attacks, including against companies that had already received its earlier warnings and taken remedial measures.

"All BFSI entities are strongly advised to treat this campaign as an immediate and continuing threat," the advisory said.

CERT-In identified several publicly available AI-driven offensive security tools being used in the attacks, including the ARTEX family of large language model (LLM)-based tools, PentAGI autonomous multi-agent AI penetration testing system and the Cairn attack search engine.

"These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses," it said.

The supporting attack infrastructure also rotates IP addresses within hours to days, making it difficult for organisations to rely on conventional detection methods.

The attackers have targeted cloud infrastructure and exploited management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files, making their activity appear like legitimate cloud operations.

The agency said attackers have reverse-engineered application codebases to develop customised exploits and subsequently initiated unauthorised API calls using modified application packages.

This has helped them defeat controls that assumed "only the legitimate client application would call the APIs", it said.

The advisory said merchant settlement APIs of payment aggregators have been exploited or abused to move funds.

CERT-In urged financial institutions to maintain round-the-clock security monitoring, with additional staffing and lower alert thresholds during weekends, holidays and other periods of reduced coverage.

It also warned companies against assuming that an attack had been fully contained after initial remediation.

"After any incident, assume persistence: perform full eradication with forensic verification and continue periodic threat hunting," it said.

The agency recommended stronger monitoring of cloud activity, strict separation of testing and production environments, and controls to prevent unauthorised changes to applications and serverless functions.

It also advised financial institutions to flag small-value transactions to new beneficiaries followed by large transfers, describing the pattern as "a strong precursor of unauthorized fund transfer".

The agency asked organisations to isolate affected systems, preserve forensic evidence, rotate credentials and report suspicious activity to CERT-In or its finance-focused response team, CSIRT-Fin.

"Upon detection of suspicious activity: isolate affected hosts, preserve forensic evidence and logs, rotate all credentials, and report to CERT-In/CSIRT-Fin," it said.