- Trending
- Comments
- Latest
India’s national cybersecurity agency, CERT-In, has named CRAFTY FALCON as an AI-assisted hacker group targeting crypto exchanges, fintech firms and lenders, warning in a November 4, 2026 advisory that the campaign is active and escalating.
The group is reportedly stealing wallet keys and timing attacks for weekends and holidays, when security teams are thinner, though CERT-In names no exchanges and gives no loss estimate.
India’s Computer Emergency Response Team has identified CRAFTY FALCON as the threat actor responsible for an escalating campaign against financial institutions and cryptocurrency businesses.
The agency issued its latest advisory on Wednesday, November 4, expanding on an October 9 warning about attackers exploiting payment and disbursement systems to initiate unauthorized transfers.
According to CERT-In, the campaign targets nonbank financial companies, digital lending platforms, fintech businesses, payment aggregators, payment service providers, and cryptocurrency exchanges.
The agency described the operation as an ongoing security threat involving increasingly sophisticated tools and attack techniques.
“The threat is active and ongoing,” — CERT-In, in its November 4 cybersecurity advisory.
Investigators said several organizations had experienced successful intrusions despite receiving earlier restricted warnings and implementing remedial measures.
Some affected companies were reportedly targeted again after failing to eliminate all traces of the initial compromise.
The findings suggest that attackers may retain access to compromised systems even after businesses believe they have addressed the original vulnerabilities.
The AI hackers also reportedly schedule attacks during weekends, public holidays, and other periods when cybersecurity monitoring is less intensive.
This approach can delay detection, allowing unauthorized transactions or data theft to continue before security personnel respond.
CERT-In has therefore classified the campaign as a critical threat requiring immediate attention from financial institutions.
Although the advisory explicitly identifies cryptocurrency exchanges among the affected business categories, it does not name individual exchanges or provide a confirmed estimate of stolen cryptocurrency.
CERT-In’s investigation identified several publicly available artificial intelligence tools allegedly used to accelerate the attack process.
These include ARTEX, an AI-assisted penetration-testing tool, alongside PentAGI, Cairn, and the CyberStrikeAI framework.
The agency reported that such tools can automate different stages of an intrusion, allowing attackers to identify potential weaknesses and generate customized malicious scripts more quickly.
The systems can also adjust attack methods based on how a targeted application responds.
CERT-In described CRAFTY FALCON as an operation that “operates at machine speed,” emphasizing the rapid execution of attacks against financial infrastructure.
According to investigators, the attackers have exploited vulnerable applications and exposed testing environments to gain access to production systems.
In some cases, compromised credentials and access tokens allowed intruders to move between internal environments that were insufficiently separated.
The attackers also reportedly targeted cloud infrastructure, using legitimate management services to execute unauthorized commands and deploy malicious files.
This technique can complicate detection because suspicious activity may appear alongside ordinary system administration operations.
CERT-In further reported that attackers examined application code to identify weaknesses and develop tailored exploits.
The use of AI hackers in these attacks demonstrates how automated tools can accelerate activities that would otherwise require substantial manual effort.
The agency also identified attempts to exploit newly disclosed software vulnerabilities shortly after technical information became publicly available.
Some intrusions reportedly involved small test transactions designed to determine whether unauthorized transfers could succeed before larger amounts were moved.
In cryptocurrency-related incidents, investigators identified stolen wallet keys and funds transferred out of affected wallets.
However, the advisory does not establish that artificial intelligence independently controls the entire criminal operation.
Rather, the evidence points to attackers using AI-assisted tools to increase the speed and effectiveness of their activities.
The latest warning adds to concerns that artificial intelligence is changing the cybersecurity challenges facing cryptocurrency exchanges and financial service providers.
In October, cybersecurity company CrowdStrike reported an incident involving South Korean financial institutions in which an unidentified attacker allegedly used ARTEX alongside Claude Code and other AI models.
The reported activity involved unauthorized access and data theft, highlighting the potential use of AI-powered tools in attacks against financial businesses outside India.
The findings are relevant to cryptocurrency exchanges because these platforms manage sensitive customer information, transaction-processing infrastructure, and digital asset credentials.
A successful intrusion can expose systems used to authorize withdrawals or manage cryptocurrency wallets.
Unlike conventional financial transfers, cryptocurrency transactions may be difficult to reverse once they have been confirmed on a blockchain.
Consequently, rapid detection and effective authorization controls are particularly important.
The growing use of AI hackers also raises questions about whether traditional security assessments can keep pace with automated vulnerability discovery.
Solana Foundation Chief Information Security Officer Michael Coates previously emphasized the importance of giving legitimate cybersecurity teams access to advanced artificial intelligence capabilities.
“We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough,” — Michael Coates, Chief Information Security Officer, Solana Foundation.
His remarks reflect concerns that cybercriminals may benefit from increasingly capable AI systems while legitimate organizations struggle to adopt equally effective defensive technologies.
TRM Labs Head of Policy Ari Redbord has similarly warned that rapidly evolving attack methods can reduce the long-term effectiveness of security audits performed only once.
The concern is particularly relevant for cryptocurrency platforms that continuously update applications, integrate external services, and process large volumes of digital asset transactions.
However, CERT-In has not publicly established a connection between CRAFTY FALCON and the separate security incidents affecting Binance or South Korean financial institutions.
The cases illustrate related cybersecurity concerns but should not be treated as evidence of a single coordinated operation.
In response to the escalating campaign, CERT-In has urged financial institutions and cryptocurrency businesses to strengthen their security monitoring and incident-response procedures.
The agency advised organizations to treat the threat as active and escalating rather than assuming that previous remediation efforts had eliminated the risk.
A central recommendation involves maintaining round-the-clock cybersecurity surveillance, particularly during weekends, holidays, and periods of reduced staffing.
CERT-In also recommended increasing security personnel during vulnerable periods and lowering alert thresholds to improve the detection of suspicious activity.
Organizations were urged to review access permissions, monitor cloud infrastructure, and strengthen the separation between testing and production systems.
The agency further emphasized the importance of protecting credentials and access tokens that could allow attackers to move between internal environments.
Financial institutions were also advised to monitor unusual transaction patterns, including small test payments followed by larger transfers.
Such activity can indicate attempts to determine whether compromised payment systems can be used to move funds without authorization.
For cryptocurrency exchanges, the theft of wallet credentials remains a particularly serious concern because compromised signing keys can enable unauthorized transfers.
As AI hackers continue adapting their methods, CERT-In’s recommendations highlight the importance of continuous security assessments rather than relying exclusively on periodic audits.
The agency also advised organizations that had previously experienced intrusions to conduct thorough investigations and verify that attackers no longer retained access.
This is especially important because the campaign reportedly includes repeated attacks against businesses that had already attempted to address earlier compromises.
The latest advisory underscores how artificial intelligence is becoming part of the operational toolkit used in financial cybercrime.
While AI technology can also strengthen fraud detection and cybersecurity monitoring, its misuse presents additional challenges for institutions responsible for protecting customer funds.
For India’s cryptocurrency and financial services industries, the immediate priority is preventing further unauthorized access and improving the speed of incident detection.
The broader significance is that AI hackers may increasingly exploit security weaknesses faster than traditional monitoring and response procedures can address them.
As the CRAFTY FALCON campaign continues, CERT-In’s warning reinforces the need for stronger coordination, continuous security reviews, and effective controls over sensitive financial infrastructure.
Copyright © 2025 - The Bit Gazette.
