India’s cybersecurity authorities have identified a hacking group using artificial intelligence to target financial institutions. The investigation has also exposed four AI-powered tools, with researchers linking at least two to China.
India’s Computer Emergency Response Team (CERT-In) has named the group “Crafty Falcon.” According to its advisory, the group has targeted non-bank lenders, fintech companies and cryptocurrency exchanges.
The disclosure comes amid growing concerns over cyberattacks against India’s financial sector. Several banks and financial companies have reported security incidents in recent weeks.
CERT-In warned that attackers use publicly available AI tools to automate system breaches “at machine speed.” The agency described the threat as “active and ongoing,” highlighting the urgency of stronger cybersecurity measures.
However, CERT-In did not identify the individuals behind the attacks or reveal where the organisation operates.
Four AI Hacking Tools Identified
The cybersecurity agency identified four tools associated with the hacking campaign:
- ARTEX
- PentAGI
- Cairn
- CyberStrikeAI
Security researchers have linked at least two of these tools to China. Among them, ARTEX has attracted particular attention because of its involvement in previous cyberattacks.
Cybersecurity firm CrowdStrike reported that ARTEX had appeared in attacks targeting South Korean banks since late September.
The tool was also linked to an espionage campaign targeting more than 200 organisations across at least 14 countries. However, CERT-In did not identify the affected companies or disclose financial losses.
Furthermore, the agency did not describe the attacks as state-sponsored operations. The identified tools were publicly available online, although ARTEX’s developer made it private last month.
How Crafty Falcon Targets Financial Systems
According to CERT-In, Crafty Falcon uses machine intelligence to examine potential targets and identify weaknesses.
The group reportedly exploits victims’ existing payment and disbursement systems to transfer money. This approach allows attackers to misuse legitimate financial infrastructure rather than relying entirely on separate payment channels.
The advisory stated that the group “surveys its targets with machine intelligence”.
Moreover, attackers reportedly schedule operations around holidays, weekends and other periods with limited monitoring. This timing can delay detection and give criminals additional opportunities to move money.
CERT-In also warned about repeated attacks against companies that previously addressed security weaknesses. Some organisations faced further breaches because their earlier remediation efforts remained incomplete.
Indian Banks Face Growing Cybersecurity Concerns
The latest warning follows several reported security incidents involving India’s financial institutions.
Last month, two Mumbai-based non-bank lenders reportedly lost approximately $2 million through more than 700 unauthorised instant transfers. The transactions occurred on October 8 and 9 through accounts associated with ICICI Bank, India’s third-largest lender.
According to a police complaint, attackers compromised application programming interfaces (APIs). These software connections allow banks, fintech companies and non-bank lenders to exchange financial instructions.
Meanwhile, State Bank of India disclosed a dark-web leak involving 3,897 customer records last month.
Non-bank lender Spandana Sphoorty Financial also reported unauthorised debits from a bank account on November 1. Additionally, AU Small Finance Bank began investigating a potential customer-data leak.
However, CERT-In has not confirmed whether Crafty Falcon was responsible for any of these individual incidents.
AI-Powered Cybercrime Raises New Security Questions
The identification of Crafty Falcon highlights how publicly available AI tools can support increasingly automated cyberattacks.
Financial institutions now face threats involving payment infrastructure, customer information and digital banking connections. Furthermore, attackers can exploit periods of reduced monitoring to make detection more difficult.
The latest advisory reinforces the importance of complete security fixes and continuous monitoring. For India’s financial sector, preventing repeated breaches remains a significant challenge.
Although investigators have identified the tools and the hacking group’s reported methods, important questions remain. Authorities have yet to establish who operates Crafty Falcon or connect it conclusively to individual banking incidents.
For the latest updates, visit and follow The Truth International website (www.thetruthinternational.com) and subscribe to the YouTube Channel.
