CriticalAPT
CERT-In’s CRAFTY FALCON Advisory: AI Is the Accelerant, Your Payment APIs Are the Target
Cyble·Source published ·1 min read
What happened?
CERT-In's critical advisory, last week, gives a name to the campaign draining Indian fintechs: CRAFTY FALCON, an "AI-assisted financial threat actor" that moves money by calling its victims' own payment and disbursement APIs. Organizations that fixed their systems after CERT-In's first warning in October have been hit again. The AI label will get the headlines. The attack chain tells a plainer story. Hardcoded API tokens, staging servers that share credentials with production, IP allow-lists that trust shared third-party fetchers: none of these weaknesses is new.
Key details
- CRAFTY FALCON uses AI to move money via victims’ own payment APIs.
- Initial breach exploits exposed staging servers, hardcoded tokens, and missing MFA.
- Attacker leverages shared credentials to run commands in production via AWS services.
- Calls from allowed infrastructure bypass KYC and transaction limits.
- Remediated entities were re‑targeted, with attacks timed for holidays and weekends.
Affected
- Indian NBFCs, digital lenders, fintechs, payment aggregators, PSPs and crypto exchanges.
What to look for
- ARTEX Docker image with hidden root shell exposed 62 consoles.
Summarised by SecOraLens from Cyble. Always read the original source before acting. How SecOraLens verifies advisories.