TLDR India’s CERT-In named an AI-assisted hacking group “CRAFTY FALCON” in an updated advisory. Crypto exchanges are now officially listed among the targets, along with lenders and fintech firms. Attackers stole crypto wallet keys and drained funds using victims’ own payment systems. Some firms that had already fixed their systems after earlier warnings were still breached. CERT-In did not name any affected exchanges or say how much money was lost.
India’s national cybersecurity agency says an AI-assisted hacking group is timing some of its attacks for weekends and holidays, when fewer staff are watching. The group has stolen crypto wallet keys and drained funds from financial firms, including crypto exchanges.
The Indian Computer Emergency Response Team, known as CERT-In, named the threat actor “CRAFTY FALCON” on Wednesday. The advisory updates a campaign the agency first warned about in October.
The new advisory is the first to name crypto exchanges among the affected businesses. It also describes how the group uses AI attack tools.
CERT-In said the threat is “active and ongoing.” It added that CSIRT-Fin, the financial sector response team, keeps receiving reports of successful attacks.
Some of those reports came from nonbank lenders and fintech firms that had already received earlier restricted warnings. These companies had taken steps to fix their systems but were still hit.
How the Attacks Work
CERT-In said the group “surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.” In simple terms, the attackers use a company’s own payment systems to move money out.
The campaign has hit nonbank lenders, digital lending platforms, fintech companies, payment aggregators and service providers. Crypto exchanges are also on the list.
Attackers broke in through weak applications and exposed testing environments. They then used