SecurityThreats & vulnerabilitiesNote
CERT-In names ‘CRAFTY FALCON’: NBFCs that remediated were attacked again
What CERT-In’s advisory CIAD-2026-0058 of 4 November adds to its 9 October warning: the attacker’s name, four AI tools, ₹1 test transfers, and the controls it asks lenders for.
CERT-In has named the attacker draining Indian lenders through their own payment APIs “CRAFTY FALCON”, and says it is still succeeding, including against NBFCs and fintechs that had received the earlier restricted warnings and had already remediated. The same entities were “deliberately re-targeted”, with attacks timed for “holidays, weekends and other low-monitoring windows”. Advisory CIAD-2026-0058, rated Critical, was issued on 4 November as an update to the 9 October advisory on payment and disbursement APIs.13
01What the update adds to the October advisory
In October CERT-In described the core trick: steal payment-gateway and partner-bank API credentials, then call the disbursal API from the lender’s own whitelisted servers, skipping loan creation, KYC and sanction checks, and send the money to mule accounts. It mentioned only the “possible use” of AI-assisted tools.3 The November update goes further on four points:1
- A name and a description. CSIRT-Fin, CERT-In’s finance-sector team, calls CRAFTY FALCON “an AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs”.
- The tools. Four publicly available AI-driven offensive tools: the “ARTEX” family of LLM-based tools, the PentAGI multi-agent penetration-testing system, the Cairn attack search engine and the CyberStrikeAI framework.
- More kinds of victim. Payment aggregators and cryptocurrency exchanges now sit beside NBFCs, digital lenders and fintechs, with merchant settlement APIs abused and wallet keys stolen.
- The test transfer. “Micro-value test transactions (such as Rs. 1)” to check that a stolen payment route works before the large transfers.
02How an attack runs, step by step
In through a test system, pose as the app, send ₹1, then the large transfers
The attack pattern in CERT-In advisory CIAD-2026-0058, severity Critical, issued 4 November 2026
- 01
Enter by a side door
Internet-facing UAT, staging or test systems, or a flaw exploited as soon as it is published; then into production on shared credentials or tokens.
- 02
Hide in cloud tools
Cloud management services such as AWS Systems Manager and Lambda run the attacker’s commands and files, blending in with normal admin traffic.
- 03
Pose as the app
The lender’s app is reverse-engineered and repackaged to call its APIs; requests route through trusted third-party fetcher IPs to pass the allow-list.
- 04
₹1 first, then the rest
A test payment to a new beneficiary proves the route; large transfers follow, often on a weekend or holiday.
Source: CERT-In, CIAD-2026-0058 · as of 4 November 2026
Two of these steps defeat controls lenders rely on. An API that trusts only the genuine app is open to anyone who rebuilds that app, so CERT-In asks for every transaction to be validated on the server, with signed requests and app attestation. And an IP allow-list that admits a shared pool, such as a content-acceleration or app-store review service, admits anyone who can make that service fetch a web address, which, the advisory notes, any internet user can.1
03Why lenders that remediated were hit again, and what CERT-In asks for
The advisory gives two reasons. Some remediation was incomplete, so CERT-In says to “assume persistence” after any incident and verify eradication forensically. And the attackers rotate their IP addresses “within hours to days”: blocking the indicators shared in October does not stop the same techniques arriving from new ones.1 Among the controls it lists:
- 24x7 monitoring with more staff and lower alert thresholds on holidays and weekends.
- Test and staging systems cut off from production: no shared credentials, tokens, API keys, databases or network paths.
- Real-time alerts on cloud audit logs: remote commands, serverless code changes, new roles, users or access keys.
- Flag a micro-value payment to a new beneficiary followed by a large one, and hold or review it; cooling periods for new beneficiaries.
- Mutual TLS, signed requests or scoped keys instead of allow-listing shared third-party IP pools.
- Maker-checker approval and reconciliation for merchant settlement instructions sent through payment-aggregator APIs.
The same shape appeared in France this week: Crédit Mutuel Arkéa says attackers moved its own funds through a supplier’s platform to other banks.
Sources
- CERT-In, CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor "CRAFTY FALCON" — 4 November 2026
- CERT-In, CIAD-2026-0058 (the same advisory, as a PDF copy hosted by MediaNama) — 4 November 2026
- CERT-In, CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities — 9 October 2026
- The Economic Times, AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months — 29 October 2026
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, Annexure I) — 28 April 2022
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
