India CERT-In Flags Crafty Falcon Attacks Using Public AI Tools
CERT-In advisory identifies Crafty Falcon targeting lenders, fintechs, and crypto exchanges with publicly available AI tools for automated intrusion.
India’s Computer Emergency Response Team (CERT-In) issued an advisory Wednesday about a threat actor tracked as Crafty Falcon that has compromised non-banking lenders, fintech companies, and cryptocurrency exchanges. The attackers used publicly available AI tools to carry out high-speed automated intrusions, according to the advisory. CERT-In described the threat as ‘ongoing and active’.
Tools Listed by CERT-In
The advisory names four tools used in the intrusions: ARTEX, PentAGI, Cairn, and CyberStrikeAI. ARTEX was previously used in attacks against South Korean banks. All four tools are freely available online. CERT-In did not say who is behind the attacks or where Crafty Falcon operates. The agency also did not characterize the campaign as state-sponsored or state-directed. The advisory does not explain whether the four tools are used together or separately, or whether they represent different stages of an attack. ARTEX’s earlier use against South Korean banks shows a history of targeting financial institutions, but the Indian advisory does not link the two campaigns.
What the Advisory Leaves Out
CERT-In did not provide a victim count, financial impact, or a timeline of observed activity. It did not specify how the AI tools were used within the attack chain, such as for reconnaissance, phishing generation, or evasion. The advisory also does not mention whether the attackers used AI tools to adapt their tactics in real time or to scale existing manual processes. The phrase ‘high-speed automated intrusion’ suggests a degree of automation, but no further technical detail is offered. The focus remains on alerting financial sector organizations to an active intrusion campaign without offering detailed technical indicators. The limited attribution means defenders cannot yet assess whether Crafty Falcon is a new group or a rebrand of a known actor.
Defensive Actions from Available Information
Security teams can use the four tool names as a starting point for threat hunting and detection rule creation. The previous use of ARTEX against Korean banks indicates the tool has been deployed against financial targets in multiple regions, but the advisory does not describe its current deployment method or associated infrastructure. Organizations in the affected sectors should review logs for signs of ARTEX, PentAGI, Cairn, or CyberStrikeAI activity. Because the advisory lacks indicators of compromise, defenders cannot simply block known hashes or domains. They may need to search for behavioral patterns or tool artifacts in network logs and endpoint telemetry. Detection may rely on identifying tool-specific strings in command lines, file names, or network traffic, but this assumes the attackers have not modified or renamed the tools. The advisory does not provide YARA rules, Snort signatures, or other detection content. Until CERT-In releases more data, the advisory serves as an early warning rather than a complete technical report. Organizations should monitor CERT-In’s website for follow-up advisories that may include more indicators or mitigation steps.