India’s CERT-In says financial companies are being attacked again after incomplete remediation of a campaign that abuses their own payment infrastructure. Its November 4 advisory names the actor CRAFTY FALCON and describes the threat as active and escalating.
The warning updates an October 9 advisory about unauthorized fund transfers at lenders, fintech companies and payment providers. That earlier report described attackers stealing payment credentials and calling transfer APIs from trusted infrastructure, bypassing checks normally performed by the application. Those checks included beneficiary verification, transaction limits and whether a legitimate underlying transaction existed.
The payment API remains the critical boundary
The new account adds cloud-management abuse, entry through exposed test environments and movement into production through shared secrets or network access. CERT-In also reports small test payments before larger transfers, attacks during low-monitoring periods, and cryptocurrency-wallet key theft. Its update extends the warning to exchanges and virtual digital asset service providers.
For defenders, a request arriving from an allowed server is therefore only one signal. The business decision still needs checking where money actually moves: who authorized the payment, which approved record supports it, and whether the requested amount and beneficiary belong to that transaction.
AI attribution needs its context
CERT-In attributes several AI-based offensive frameworks to the campaign. It describes rapidly refined script variants as consistent with AI-assisted development. The public advisory does not provide the full underlying evidence: detailed indicators, infrastructure fingerprints and detection rules were distributed separately at restricted sharing levels. The agency’s account should not be read as independent proof that every reported intrusion was fully autonomous.
The October guidance already recommended binding the stages of a transaction, requiring a second approval for fund movements and reconciling payments with approved records and bank statements. These controls address the financial outcome rather than depending solely on detecting the tool used to reach the API.
The updated recommendations emphasize separating test and production environments, monitoring cloud audit events, investigating persistence after incidents and scrutinizing small payments followed by larger ones. A useful review connects application, identity and payment records so an apparently valid API request can be checked against the business action it claims to represent.
