CERT-In's Alarming Warning on Cyberattacks
India's [cybersecurity](/topic/cybersecurity) agency, the Indian Computer Emergency Response Team (CERT-In), has raised alarms regarding a series of sophisticated AI-driven cyberattacks targeting financial institutions across the country. The warning, issued on November 4, 2026, specifically highlights the activities of a hacking group known as Crafty Falcon, which has been exploiting vulnerabilities in banks, non-banking lenders, fintech firms, and cryptocurrency exchanges.
According to CERT-In, these attacks are not only persistent but also highly automated, utilizing publicly available AI tools to identify and exploit weaknesses in financial systems. The agency has identified four specific AI tools involved in these attacks: ARTEX, PentAGI, Cairn, and CyberStrikeAI. Notably, at least two of these tools have been linked to previous cyber operations allegedly orchestrated by the Chinese government against Indian financial institutions.
The Tools of the Trade: AI in Cybercrime
The tools identified by CERT-In are designed to enhance the efficiency of cyber intrusions. ARTEX, for instance, has been previously reported by cybersecurity firm CrowdStrike as being used in attacks against South Korean banks since late September 2026. This tool, along with others, has been linked to a broader espionage campaign that targeted over 200 organizations across 14 countries.
The use of AI in these cyberattacks marks a significant evolution in the tactics employed by hackers. CERT-In noted that Crafty Falcon is developing machine intelligence to automate the identification of targets and streamline the execution of cyber intrusions. This capability allows the group to operate with a level of sophistication that poses a serious threat to the financial sector.
Exploiting Vulnerabilities During Low-Monitoring Periods
One of the most concerning aspects of these attacks is the timing of their execution. CERT-In reported that the attackers have been exploiting existing payment and disbursement mechanisms of financial companies during weekends, holidays, and other low-activity periods. This strategy minimizes the likelihood of detection, as fewer employees are available to monitor systems during these times.
Moreover, the agency highlighted that companies that had previously addressed vulnerabilities following earlier security alerts were still targeted. This indicates that the attackers are adept at exploiting incomplete security fixes, allowing them to re-enter systems that were thought to be secure.
Recent Incidents Highlighting the Threat
The CERT-In advisory comes on the heels of several alarming incidents affecting financial institutions in India. For instance, two Mumbai-based non-banking lenders reported losses of approximately $2 million due to over 700 unauthorized instant transfers that occurred on October 8 and 9, 2026. These transactions were processed through ICICI Bank, one of India's largest banks.
The complaint filed by the affected lenders alleged that hackers gained access to application programming interfaces (APIs) that facilitate communication between banks, lenders, and fintech firms regarding payments and loan disbursements. This breach underscores the vulnerabilities present in the digital infrastructure of financial institutions.
Additionally, State Bank of India revealed a significant data leak involving 3,897 customer records on the dark web. Other institutions, such as Spandana Sphoorty Financial and AU Small Finance Bank, have also reported unauthorized debits and potential data leaks, further emphasizing the urgent need for enhanced cybersecurity measures.
The Growing Threat of AI-Powered Cybercrime
The warning issued by CERT-In serves as a stark reminder of the increasing threat posed by AI-powered hacking, particularly to financial institutions with complex digital ecosystems. As cybercriminals continue to refine their tactics and leverage advanced technologies, the need for robust cybersecurity measures becomes more critical than ever.
Industry experts are urging financial institutions to adopt a proactive approach to cybersecurity, including regular assessments of their systems, timely updates to security protocols, and comprehensive employee training to recognize and respond to potential threats.
In conclusion, the emergence of AI-driven cyberattacks, as highlighted by CERT-In, poses a significant risk to India's financial sector. As the landscape of cybercrime evolves, so too must the strategies employed by institutions to safeguard their operations and protect sensitive customer data.
| Metric | Value |
|---|---|
| Number of AI Tools Identified | 4 |
| Estimated Losses from Recent Attacks | $2 million |
| Number of Unauthorized Transfers | 700 |
| Number of Customer Records Leaked | 3,897 |
| Countries Targeted by ARTEX | 14 |
