Hacking group uses AI tools to attack Indian financial firms, CERT-In says

India's cyber security agency has named a hacking group behind a wave of attacks on financial firms.

The group uses artificial intelligence, or AI, tools to break in.

The Indian Computer Emergency Response Team, known as CERT-In, issued an advisory on Wednesday.

It names the group as Crafty Falcon.

The group has breached non-bank lenders, fintech firms and cryptocurrency exchanges.

CERT-In did not say who is behind the breaches or where the group operates.

The Economic Times reported this, citing Reuters.

Key points

• CERT-In has named the hacking group Crafty Falcon.
• The group uses publicly available AI tools to break in quickly.
• At least two of the four named tools are linked to China.
• Two Mumbai-based lenders reportedly lost about $2 million.

So how are these attacks being carried out?

CERT-In says the attackers use publicly available AI tools to automate break-ins. It calls the threat "active and ongoing."

The agency named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI.

Security researchers have linked at least two of them to China.

According to the cybersecurity firm CrowdStrike, ARTEX has been used in attacks on South Korean banks since late September.

Its developer made the tool private last month, after the link came up.

CERT-In also said the group times its attacks around holidays and weekends. Those are periods when monitoring is often low.

What did these attacks cost, and who was hit?

Reuters, citing a police complaint, reported a loss of about $2 million.

Two Mumbai-based non-bank lenders lost the money in more than 700 unauthorised instant transfers.

The transfers came from accounts at ICICI Bank, India's third-largest lender, on October 8 and 9.

The complaint says hackers compromised software links that carry loan instructions between banks and lenders.

State Bank of India, the country's largest lender, also disclosed a dark-web leak of 3,897 customer records last month.

CERT-In did not say which incidents are linked to Crafty Falcon.

So why does this matter for ordinary people?

The Reserve Bank of India has tightened cybersecurity checks after the recent attacks.

Its checks are meant to protect customers' money and data.

The advisory also says some firms were attacked again after their fixes were incomplete.

So firms must repair flaws fully, not partly.

CERT-In, the Indian Cybercrime Coordination Centre and the IT ministry did not immediately reply to requests for comment.

Sources

• The Economic Times: India flags Chinese-linked AI tools in hacking campaign against financial firms