India's CERT-In warns AI-powered gang CRAFTY FALCON uses 4 open-source offensive AI tools to drain fintechs
cyb3rops · x · 2026-11-05
India's cyber agency CERT-In issued a Critical advisory (CIAD-2026-0058) naming the threat actor CRAFTY FALCON, which is attacking financial institutions using four publicly available AI offensive-security systems: LLM-based ARTEX, the PentAGI autonomous multi-agent pentest framework, the Cairn attack search engine, and CyberStrikeAI.
Key facts:
- Targets include NBFCs, digital lenders, fintechs, payment aggregators and crypto/VDA service providers, abusing payment and disbursement APIs for unauthorized transfers
- Attackers test transfers with just ₹1 before moving larger sums
- Firms that already received prior advisories and attempted remediation are still being successfully breached, some deliberately re-targeted
- Intrusions are timed to weekends and holidays when security monitoring is reduced
- The tools execute full attack chains autonomously at machine speed, generating and refining tailored attack scripts and adapting payloads based on target responses; infrastructure rotates IPs within hours
More from Safety
- UW study: leading AI models rate Chinese and Nigerian accents lower in speech scoring — lazowska · 2026-11-05
- CoT controllability far higher than evals suggest: self-instructions beat prompts, can evade monitors — kastnerkyle · 2026-11-05
- US policymaker's call to pause AI sparks debate on technical literacy in politics — nickbaumann_ · 2026-11-05
- How "reverse game theory" mechanism design could keep AI agents in check — HazanPrinceton · 2026-11-05
- 2.1M Linux servers exposed to CVSS 9.8 kernel flaw CVE-2026-98432, Ubuntu patch pending — nicolascraske · 2026-11-05
- Woman dies after ChatGPT told her to stop epilepsy medication; family sues OpenAI — ComicSandsNews · 2026-11-05