Indian cybersecurity agencies have warned that a AI assisted threat actor is escalating hacker activities targeting cryptocurrency exchanges and other financial enterprises, stealing wallet keys and transferring funds.
On Wednesday, the National Computer Emergency Response Center of India ( CERT-In ) named the threat actor as “ CRAFTY FALCON ” and updated its warning issued for the first time in October. The latest notification now explicitly lists cryptocurrency exchanges as one of the affected enterprises and provides detailed information on the use of the AI attack tool.
CERT-In indicates that the threats are active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including those from NBFC and fintech entities that had previously received early warnings and have taken remedial actions.
This warning further indicates that hackers are using the AI tool to attack financial institutions. In October, cybersecurity company CrowdStrike reported that an unidentified attacker used ARTEX – a penetration testing tool also mentioned in the CERT-In advisory – as well as Claude Code and other AI tools to infiltrate Korean financial companies and steal data.
CRAFTY FALCON operates at "machine speed"
CERT-In indicates that this AI auxiliary financial threat actor 'scouts targets with machine intelligence, operates at machine speed, and carries out attacks by exploiting the victims' own payment and allocation API.
The targets of this event include non-bank lending institutions, digital lending platforms, fintech companies, payment aggregators and service providers, as well as cryptocurrency exchanges.
According to CERT-In, attackers exploited vulnerable applications and exposed test environments to gain access to the production system using shared credentials and access tokens. They also deployed malicious files on the cloud infrastructure.
AI tools help attackers quickly generate and optimize attack scripts. Attackers also perform reverse engineering on application code to develop customized exploit programs; some attacks are scheduled on weekends and holidays to delay detection.
Relevant reports: Binance claims that a $6.3 billion hacker attack originated from fake job interviews and a compromised AI tool
In some incidents, attackers first use small test transactions to verify unauthorized transfers before moving larger amounts of money. CERT-In also reports that cryptocurrency wallet keys have been stolen, and the funds within those wallets have been transferred away.
The institution did not name any affected cryptocurrency exchanges, nor did it disclose the amount of losses.
Cointelegraph has contacted CERT-In, CoinDCX, CoinSwitch, WazirX, ZebPay, and Mudrex to solicit their comments.
CERT-In It is recommended that relevant entities regard this activity as "active and ongoing," and high-risk companies are urged to strengthen 24/7 security monitoring. During holidays, weekends, and other times of reduced coverage, additional personnel should be assigned, and the alarm thresholds should be lowered.
Solana Foundation Chief Information Security Officer Michael Coates previously stated that even legitimate security teams need to access the most powerful AI tools.
He said, "We need to ensure that the defenders have access to the best models we can obtain, because attackers will also have powerful tools at their disposal."
TRM Labs Policy Director Ari Redbord also stated in July to Cointelegraph, "The evolution speed of attack techniques has become so fast that a single audit on the launch day is no longer sufficient to cover all aspects," and called for ongoing security reviews.
Magazine: Why is the largest company in the AI sector suddenly asking to slow down its pace?
