BENGALURU/MUMBAI: India’s cybersecurity agency named the hacking group behind a wave of AI-driven attacks on financial firms and identified its tools, at least two of them linked to China, adding India to a growing list of countries where such tools have been used against banks.
The group, which the Indian Computer Emergency Response Team (CERT-In) calls “Crafty Falcon,” has breached non-bank lenders, fintech firms and cryptocurrency exchanges, according to an advisory issued on Wednesday (Nov 4).
CERT-In did not say who was behind the breaches or where the organisation operates.
The advisory came after a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, even as authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks.
CERT-In said the attackers use publicly available AI tools to automate break-ins “at machine speed”, calling the threat “active and ongoing”.
It named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China.
China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said.
It said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.
CERT-In did not name the affected companies or say how much money was stolen.
The agency did not say the attacks were state-sponsored and the tools it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked to the South Korean attacks.
CERT-In, the Indian Cybercrime Coordination Centre and India’s IT ministry did not immediately respond to requests for comment.
