Overview
India’s Computer Emergency Response Team (CERT-In) has issued an active advisory identifying a threat actor tracked as Crafty Falcon conducting AI-assisted attacks against Banking, Financial Services, and Insurance (BFSI) organisations. The campaign, confirmed as ongoing as of November 2026, involves the weaponisation of publicly available AI-driven offensive security tools — including ARTEX, PentAGI, Cairn, and CyberStrikeAI — one of which has been confirmed to carry a backdoor granting root access to at least 62 consoles.
The significance of this campaign lies not only in the financial impact but in what it demonstrates about the operational maturity of AI-enabled threat actors: autonomous attack chain execution, real-time payload adaptation, and rapid infrastructure rotation.
Technical Analysis
Crafty Falcon’s methodology is notable for its layered and adaptive attack surface exploitation:
Initial Access Vectors:
- Exploitation of internet-facing applications and exposed APIs
- Supply chain compromise via forged commits to source code repositories
- Harvesting of hardcoded, plaintext, or long-lived static API tokens from config files and databases
- Targeting of applications lacking MFA
AI Tool Abuse: Tools like ARTEX — delivered via what appears to be a backdoored container image — are used to autonomously generate and iterate attack scripts at machine speed. These tools adapt payloads based on live target responses, dramatically compressing the attack timeline. Supporting infrastructure rotates IP addresses within hours to days, complicating blocklist-based defences.
Post-Exploitation Tradecraft:
- Reverse-engineering application codebases to build tailored exploits
- Initiating Rs. 1 micro-transactions to validate unauthorised fund flows before large transfers
- Invoking fund-transfer APIs from within allow-listed infrastructure, defeating application-level controls
- Abusing merchant settlement APIs of payment aggregators
- Deleting logs and tampering with endpoint security tooling to hinder incident response
- Pivoting from non-production cloud environments to production systems using shared credentials and tokens
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| ATLAS AML.T0047 | AI-Enabled Product or Service | ARTEX/PentAGI used as offensive AI agents |
| ATLAS AML.T0010 | AI Supply Chain Compromise | Backdoored ARTEX image distributed via supply chain |
| ATLAS AML.T0115 | Publish Poisoned AI Artifacts | Backdoored container image deployed to targets |
| ATLAS AML.T0083 | Credentials from AI Agent Configuration | API tokens harvested from config files |
| OWASP LLM05 | Supply Chain Vulnerabilities | Compromised AI tooling introduced via trusted repositories |
| OWASP LLM08 | Excessive Agency | Autonomous AI tools executing full attack chains without human gating |
Impact Assessment
The campaign has resulted in confirmed root-level access to 62 consoles and direct theft of cryptocurrency keys and funds. The abuse of allow-listed infrastructure to invoke payment APIs is particularly damaging as it defeats conventional application-layer fraud controls including KYC, beneficiary verification, and per-transaction limits. Non-production environment compromise enabling production pivot represents a systemic risk to organisations with shared credential practices.
Mitigation & Recommendations
- Verify AI tool provenance — Validate cryptographic signatures of all container images and AI tool packages before deployment; treat community-sourced offensive security tools as untrusted by default.
- Eliminate static credentials — Rotate all long-lived API tokens and enforce short-lived, scoped credentials across payment and partner integrations.
- Enforce MFA universally — Including on non-production, internal, and API-facing services.
- Segregate environments — Ensure non-production systems cannot access or share credentials with production infrastructure.
- Monitor for micro-transactions — Flag and alert on sub-rupee or sub-cent transactions as indicators of fraud validation behaviour.
- Instrument API call provenance — Detect and block API calls originating from modified or non-standard client packages.