Threat actor targets Indian fintechs on weekends, CERT-IN warns

India’s Computer Emergency Response Team has warned the nation’s financial services industry of a significant escalation in attacks by what it describes as an AI-assisted financial threat actor. The actor, named CRAFTY FALCON, has re-targeted victims after incomplete remediation and timed attacks to coincide with holidays, weekends and other low-monitoring windows.

What CERT-IN reported

CERT-IN first detected the attacks in October and issued an advisory warning digital lending platforms, fintech entities, payment service providers and wallet operators. Attackers were targeting internet-facing applications, exposed APIs and privileged endpoints, and if they found a way in they tried to use payment APIs to steal money. On Thursday, the CERT published an update saying it continues to hear of successful attacks, including from outfits that tried to remediate their systems after earlier incidents. The same entities have been deliberately re-targeted, including after incomplete remediation, and attacks have been timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.

Tools and tactics

The security organization has named the attackers CRAFTY FALCON and revealed that the crew uses AI-enhanced tools including the ARTEX pen-testing tool, the Cairn attack search engine and the CyberStrikeAI framework, all of which have been linked to users who appear to speak Chinese. CRAFTY FALCON looks for internet-exposed environments used for testing or development, where it finds artefacts such as shared credentials, tokens or network paths that help it move into production systems. If it gets in, the crew re-writes victims’ applications so they do things like make unauthorized API calls, and victims’ defenses assume that only legitimate apps would call those APIs, so activity conducted by the re-written apps is not flagged as an attack. The crew also creates many functionally identical variants refined in rapid succession, a pattern consistent with AI-generated code and iterative AI-assisted development, and it quickly exploits newly discovered vulnerabilities to keep its attacks fresh.

How money is stolen

Once it gets a toehold, the criminal crew makes tiny payments of about $0.01 to test if its attacks work. If those transfers work, CRAFTY FALCON makes larger payments. When the target is a cryptocurrency exchange or virtual digital asset service provider, the crew steals wallet keys and empties cryptocurrency wallets.

Advice for defenders

CERT-IN’s advice to Indian businesses includes improving their ability to log events, monitor for anomalies in real time and send alerts. It also urged keeping test environments off the internet and restricting access to cloud resources because CRAFTY FALCON is fond of using them to run its attacks. The CERT warned that the attacks are active and escalating and therefore worthy of 24x7 monitoring. The advisory mentions attacks on entities across banking, financial services and insurance, but only names the kinds of businesses mentioned above as having reported attacks. India is home to thousands of banks, many of them small operations that sometimes lack basic infosec protections, so CRAFTY FALCON has a target-rich environment in India should it choose to expand its activities.

Sources: The Register