TLDR
- India’s CERT-In named an AI-assisted hacking group “CRAFTY FALCON” in an updated advisory.
- Crypto exchanges are now directly listed among the businesses being targeted.
- Some firms were breached again after they had already fixed their systems.
- Attackers stole crypto wallet keys and drained funds, often striking on weekends and holidays.
- The agency did not name affected exchanges or say how much money was lost.
India’s national cybersecurity agency says an AI-assisted hacking group is still breaking into financial firms, including crypto exchanges. Some of the victims had already patched their systems after earlier warnings.
The Indian Computer Emergency Response Team, known as CERT-In, named the threat actor “CRAFTY FALCON” in an advisory released on Wednesday. The update builds on a warning the agency first issued in October.
The new advisory is the first to name crypto exchanges directly among the affected businesses. It also describes how the attackers use AI tools to plan and carry out their attacks.
Firms Hit Even After Earlier Warnings
CERT-In said the campaign has not slowed down. “The threat is active and ongoing,” the agency said.
The agency said its financial sector response team, CSIRT-Fin, keeps receiving reports of successful attacks. Some came from nonbank lenders and fintech companies that had already received earlier restricted advisories and had taken steps to fix their systems.
Other targets include digital lending platforms, payment aggregators and service providers. CERT-In said the attackers stole cryptocurrency wallet keys and drained funds from wallets.
The agency did not name any affected crypto exchanges. It also did not say how much money was lost.
Cointelegraph contacted CERT-In and several Indian crypto platforms for comment. These included CoinDCX, CoinSwitch, WazirX, ZebPay and Mudrex.
How the AI-Assisted Attacks Work
CERT-In said the group “surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.” In simple terms, the attackers use a company’s own payment systems to move money out.
The attackers first broke into weak applications and testing environments that were exposed online. From there, they used shared login details and access tokens to move into live production systems.
They also went after cloud infrastructure to plant malicious files. AI tools helped them quickly write and improve attack scripts.
The group reverse-engineered application code to build exploits made for each target. In some cases, the attackers sent small test transactions to confirm a transfer would work before moving larger amounts.
Some attacks were timed for weekends and holidays, when fewer staff are watching. CERT-In said this helped the attackers delay detection.
CERT-In named ARTEX, an AI penetration-testing tool, in its advisory. In October, cybersecurity firm CrowdStrike reported that an unknown attacker used ARTEX, along with Claude Code and other AI models, to breach South Korean financial firms and steal data.
Security experts have spoken about this trend before. Solana Foundation chief information security officer Michael Coates told Cointelegraph that defenders need access to the strongest AI tools. “We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough,” he said.
In July, TRM Labs head of policy Ari Redbord said “attack techniques are moving faster than a single audit from launch day can account for.” He called for ongoing security reviews.
CERT-In has now told at-risk firms to “treat this campaign as active and escalating.” The agency urged companies to monitor their systems around the clock.
It also advised firms to add more staff and lower alert thresholds during holidays, weekends and other times when coverage is low.
