November 5, 2026
India’s cybersecurity agency has named the hacking group behind a wave of AI-driven attacks on the country’s financial firms: “Crafty Falcon,” which it says uses publicly available AI tools to automate break-ins at machine speed. Why it matters: this is a national regulator putting a name, a toolkit and a method to AI-accelerated financial crime — and warning that the campaign is active and ongoing.
What happened
In an advisory issued on Wednesday, the Indian Computer Emergency Response Team (CERT-In) said Crafty Falcon has breached non-bank lenders, fintech firms and cryptocurrency exchanges. The advisory follows a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, during which authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks. CERT-In did not say who is behind the group or where it operates, did not name the affected companies, and did not say how much money was stolen.
The tools CERT-In named
CERT-In named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China, according to Reuters’ report of the advisory. China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said, and a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries. The tools themselves have been freely available online, and ARTEX was made private by its developer last month after it was linked to the South Korean attacks. CERT-In did not say the attacks were state-sponsored.
How the attacks work
According to the advisory, Crafty Falcon surveys its targets with machine intelligence and then moves money by invoking the victims’ own payment and disbursement systems — turning a lender’s legitimate transfer machinery against it. Attacks were timed around holidays, weekends and other low-monitoring periods to delay detection. In a detail defenders should note, firms that had fixed flaws after earlier alerts were attacked again where the remediation was incomplete.
The broader backdrop, which CERT-In did not explicitly tie to Crafty Falcon: Reuters previously reported, citing a police complaint, that two Mumbai-based non-bank lenders lost about $2 million in more than 700 unauthorised instant transfers on October 8 and 9, after hackers compromised the application programming interfaces that connect banks with lenders and fintechs. State Bank of India disclosed a dark-web leak of 3,897 customer records last month, non-bank lender Spandana Sphoorty Financial reported unauthorised debits on November 1, and AU Small Finance Bank is probing a potential customer-data leak. CERT-In, the Indian Cybercrime Coordination Centre and India’s IT ministry did not immediately respond to Reuters’ requests for comment.
Why it matters
The pattern here is the story: no bespoke nation-state malware is required. Freely available AI tools are being used to automate reconnaissance and break-ins fast enough that the weak points are now operational — holiday staffing, half-finished patches, and the APIs that move money between banks and the lenders plugged into them. For any financial firm, the practical takeaways from the advisory are unglamorous: finish remediations completely, watch payment interfaces hardest when staffing is thinnest, and assume an attacker who finds a flaw once will come back to check whether you really fixed it.
Frequently asked questions
What is Crafty Falcon?
The name CERT-In gives to the hacking group behind a wave of AI-driven attacks on Indian non-bank lenders, fintech firms and cryptocurrency exchanges, described in an advisory issued on Wednesday. CERT-In did not say who operates the group or where it is based.
Which AI tools did CERT-In name?
Four: ARTEX, PentAGI, Cairn and CyberStrikeAI. Researchers have linked at least two to China, and CrowdStrike has said China-made ARTEX was used against South Korean banks from late September. The tools have been publicly available.
Did CERT-In blame the Chinese government?
No. CERT-In did not say the attacks were state-sponsored, and it did not attribute the group to any country. The China links reported by Reuters concern the tools’ origins and prior use by a China-linked group.
How much money has Crafty Falcon stolen?
CERT-In did not say, and it did not link specific incidents to the group. Reuters separately reported about $2 million lost by two Mumbai-based non-bank lenders in October in an API-compromise case described in a police complaint.
Sources: Reuters, CERT-In advisory (via Reuters)