CERT-In Reports China-Linked AI Cyber Attacks on Indian Banks: Hackers Exploit Vacations, Low-Monitoring Windows

India’s Computer Emergency Response Team (CERT-In), the country’s cyber security agency, has issued a warning about a number of cyber attacks using AI technologies. Attacks could target financial institutions, including non-bank lenders (NBLs), fintech firms and cryptocurrency exchanges.

The agency on Wednesday (November 4) alerted a hacking group known as ‘Crafty Falcon’ and four AIs allegedly used to automate attacks on financial institutions in India, Reuters reported.

The agency said the attacks are active and persistentusing AI tools publicly available on the Internet to quickly exploit vulnerabilities in systems. CERT-In identified four tools, at least two of which were allegedly used by the Chinese government against financial institutions in India, while cybersecurity researchers linked India to some of the tools identified by CERT-In.

CERT-In identifies 4 AI tools used in attacks

CERT-In says the group is developing machine intelligence to identify targets and automate cyber intrusions. The agency identified four tools that played a role in the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI.

Cybersecurity firm CrowdStrike previously reported that the ARTEX tool, developed in China, had been used in attacks targeting South Korean banks since late September. The firm also linked the tool to a hacking group allegedly linked to China, which was behind an espionage campaign against more than 200 organizations in at least 14 countries.

CERT-In was unable to identify the persons or entities behind Crafty Falcon. Nor did it say whether the attacks were state-sponsored. All the tools he mentioned in his recommendation were already on the Internet, but its developer took ARTEX private last month after allegations linked it to the South Korean attacks.

Read also | Nothing’s native AI product is set to launch in December; CEO Carl Pei shares the details

Hackers abuse payment systems during periods of low monitoring

The attackers used the existing payment and disbursement mechanisms of financial companies to transfer funds, CERT-In said. They allegedly operated on weekends, holidays and when organizations were less busy, with fewer employees monitoring their systems.

The agency also warned that companies that addressed vulnerabilities after earlier security alerts were targeted again when their fixes were not complete. This means that attackers were trying to exploit previously compromised security systems and take advantage of unpatched loopholes.

Counseling follows in sequence cyber incidents affecting financial institutions in India in recent weeks that have led to new concerns about the security of the banking interface and digital payment systems.

Read also | Moonshot AI Launches Kimi K3.1 Pro With Better Coding Skills And Reduced Cyber Risk

Recent cyber attacks are raising concerns across the Indian financial sector

Citing a police complaint, Reuters had earlier reported that two Mumbai-based non-bank lenders lost about $2 million through more than 700 unauthorized instant transfers on October 8 and 9. The trades were handled through ICICI Bank, India’s third largest bank.

The complaint alleges that the hackers penetrated the application programming interfaces (APIs) that allow banks, lenders and fintech firms to communicate about payments and lending.

Security incidents have also been reported at other financial institutions. Last month, State Bank of India disclosed the leak of 3,897 records of its customers on the dark web. Spandana Sphoorty Financial reported unauthorized bank account debits on November 1, while AU Small Finance Bank said it was investigating a potential breach of customer data.

This CERT-In warning indicates the growing threat of artificial intelligence hacking, especially for financial institutions with complex payment ecosystems and digital infrastructure.