India Warns Banks of AI-Driven CRAFTY FALCON Cyberattacks

The Indian Computer Emergency Response Team (CERT-In) and the Indian Cyber Crime Coordination Centre (I4C) issued a critical advisory on November 4 warning the banking, financial services, and insurance sectors of an escalating AI-driven cyberattack campaign. The threat actor, identified as CRAFTY FALCON, utilizes an Agentic AI Framework and offensive tools such as ARTEX and PentAGI to automate attack sequences and identify vulnerabilities at machine speed.

Attackers target banks, fintech firms, and cryptocurrency exchanges by exploiting unpatched software, misconfigured servers, and vulnerable payment APIs. Once inside, they execute multi-crore unauthorized transactions, routing stolen funds through mule accounts via IMPS and NEFT before deleting records to obstruct investigations. CERT-In noted that CRAFTY FALCON often times operations during weekends and holidays to bypass security monitoring and frequently targets organizations that had previously undergone remediation.

In response, authorities have mandated that financial institutions report cybersecurity incidents to CERT-In and the Reserve Bank of India within six hours of detection. Institutions are directed to align security controls with a May 2026 CERT-In blueprint, maintain strict API inventories, and implement round-the-clock monitoring. This warning follows a surge in cyber fraud in India, with Union Home Ministry data showing over 53 lakh complaints and losses exceeding Rs 56,087 crore between FY 2023-24 and 2025-26.