India's Computer Emergency Response Team has issued a fresh warning about a sustained campaign of artificial intelligence-assisted cyberattacks targeting financial institutions and digital asset platforms. The agency named the threat actor Crafty Falcon and listed four publicly available tools employed in the operations, at least two of which security researchers have connected to Chinese developers.

The advisory describes the campaign as active and ongoing. Attackers have compromised non-bank lenders, fintech companies and cryptocurrency exchanges, using automated systems to identify weaknesses and move funds through the victims' own payment and disbursement interfaces.

Tools and Methods Identified

CERT-In identified ARTEX, PentAGI, Cairn and CyberStrikeAI as the primary instruments. These systems allow operators to survey targets with machine intelligence, generate and refine custom scripts at high speed, and adapt payloads according to system responses. Attack chains can run with limited human intervention once launched.

Researchers have linked ARTEX to China. The tool previously appeared in attacks on South Korean banks that began in late September. A separate China-linked group also deployed it in an espionage campaign that reached more than 200 organisations across at least 14 countries. The developer of ARTEX restricted public access to the tool last month after those incidents came to light. CERT-In did not attribute the current Indian campaign to any state or specific organisation and noted that the listed tools remain freely available online.

Attackers have targeted cloud infrastructure, abused management services such as AWS Systems Manager and Lambda to run commands and place malicious files, and entered production systems through exposed testing and staging environments. In some cases they reverse-engineered application code to craft tailored exploits and initiated unauthorised API calls through modified packages. Attempts to bypass IP allow-listing by routing traffic through approved third-party fetcher pools have also been observed.

Operators have conducted micro-value test transfers, including amounts as small as 1 Indian rupee, equivalent to about 0.011 US dollars, to confirm successful fund movement before scaling up the transfers. Timing has favoured holidays, weekends and other periods of reduced monitoring, which delays detection.

Scope of the Campaign and Related Incidents

The agency reported that entities already alerted in earlier restricted advisories have been hit again when remediation remained incomplete. CERT-In did not identify the specific companies affected by Crafty Falcon or disclose the total value of assets taken. It also stopped short of linking the group to every recent breach reported in the sector.

Separate recent cases include a police complaint describing losses of about 2 million US dollars at two Mumbai-based non-bank lenders. Those losses occurred through more than 700 unauthorised instant transfers drawn from accounts at ICICI Bank on 8 and 9 October. The complaint stated that the attackers compromised application programming interfaces used to issue loan-disbursal instructions between banks and non-bank lenders.

State Bank of India disclosed a dark-web leak of 3,897 customer records last month. Spandana Sphoorty Financial reported unauthorised debits from a bank account on 1 November, while AU Small Finance Bank said it was examining a possible customer-data leak. CERT-In has not confirmed any connection between these events and the Crafty Falcon activity.

Response and Ongoing Risk

The latest advisory follows a series of incidents that prompted the Reserve Bank of India to strengthen cybersecurity scrutiny of regulated entities. CERT-In, the Indian Cybercrime Coordination Centre and the IT ministry did not immediately provide further comment when contacted.

The agency has urged financial firms and crypto platforms to complete outstanding remediation, tighten monitoring of API activity and payment flows, and review exposure of cloud management services and staging environments. The combination of publicly available AI-driven tools and the ability to operate at machine speed continues to present a live threat to institutions that have not fully closed previously identified gaps.