CERT-In warns financial sector over AI-driven cyberattacks

The Indian Computer Emergency Response Team issued a critical warning to financial institutions. The cyber agency flagged a sharp rise in unauthorized fund transfers nationwide.

Threat actors deployed an artificial intelligence-powered campaign called Crafty Falcon. These automated tools rapidly exploit security gaps across banking networks.

Attackers successfully breached banks, NBFCs, and fintech companies. Several targeted entities had already received previous alerts in October regarding payment API vulnerabilities.

Intruders repeatedly struck organizations that failed to fix identified weaknesses. They strategically launched attacks during weekends and holidays to minimize immediate detection.

CERT-In revealed that hackers use public AI tools to generate attack scripts. These intelligent platforms adapt malware automatically with minimal human intervention.

Cybercriminals actively target internet-facing test environments and cloud setups. They exploit compromised credentials and system flaws to gain deep network access.

Hacker groups use modified mobile applications to execute fraudulent transactions. They also manipulate application programming interfaces to move illicit funds quickly.

Malicious actors route network traffic through trusted third-party services. This tactic allows attackers to bypass standard enterprise security controls undetected.

Criminals initially process low-value transactions to test vulnerable systems. Once verified, they execute much larger fraudulent money transfers across accounts.

Recent cyberattacks targeted major Indian lenders like State Bank of India. Spandana Sphoorty and AU Small Finance Bank also suffered intrusions.