Mint Explainer | How AI-driven cyberattacks are targeting India's financial sector

The Indian Computer Emergency Response Team (CERT-In) has warned of escalating AI-driven cyberattacks on financial institutions, with hackers increasingly exploiting their own payment infrastructure to initiate unauthorized transactions.

In an advisory issued on 4 November, CERT-In identified the threat actor as “Crafty Falcon” and classified the campaign as critical. The warning coincides with the agency's new AI Security Auditing Guidelines, which establish a risk-based framework for assessing the security of artificial intelligence systems.

Mint explains.

What exactly is Craft Falcon?

Craft Falcon is an AI-assisted financial threat actor identified by CERT-In's Computer Security Incident Response Team-Finance (CSIRT-Fin). Its targets include banks, non-banking financial companies (NBFCs), digital lenders, fintech firms, payment aggregators and service providers, and cryptocurrency exchanges.

Attackers use AI to identify vulnerabilities, execute attacks at machine speed and exploit institutions' payment and disbursement application programming interfaces (APIs), according to the agency.

The latest advisory updates a 9 October warning. CERT-In said attacks continued even against entities that had received restricted advisories and undertaken remediation.

How are attackers using AI to breach financial systems?

CERT-In has identified several publicly available offensive AI tools used in the campaign, including the ARTEX family of large language model-based tools, PentAGI, an autonomous multi-agent AI penetration-testing system, the Cairn attack search engine and CyberStrikeAI.

These tools can autonomously execute attack chains, generate and refine scripts, and adapt payloads to responses from targeted systems. Attackers also rotate internet protocol (IP) addresses within hours or days to evade detection and blocking.