Crafty Falcon: How an AI-Assisted Actor Steals From Indian BFSI Through Its Own APIs
By ScruteXPublished
An Indian NBFC can patch the flaw, close the ticket and still lose money the next weekend. That is what CERT-In described on 04 November 2026, when its finance unit named a new threat actor and said the same entities were attacked again after they had already remediated.
Crafty Falcon is an AI-assisted financial threat actor named by CSIRT-Fin, the finance unit of CERT-In, in advisory CIAD-2026-0058. It uses four publicly available AI offensive tools (ARTEX, PentAGI, Cairn and CyberStrikeAI) to find weak points in Indian NBFCs, digital lenders, fintechs, payment aggregators and crypto exchanges. It then moves money by calling the victim's own payment and disbursement APIs. CERT-In rates the campaign Critical and says it is active and ongoing.
Researchers link at least two of the four tools to China-based developers. CERT-In itself names no country, sponsor or operator location, and this post does not either.
Crafty Falcon at a glance
| Field | Detail |
|---|---|
| Name | CRAFTY FALCON (designated by CSIRT-Fin, CERT-In) |
| Type | Financially motivated, AI-assisted cybercrime |
| First named | 04 November 2026 (CIAD-2026-0058). Updates CIAD-2026-0046 of 09 October 2026 |
| Attribution | Not attributed by CERT-In. Two of the four tools trace to China-based developers |
| Primary targets | NBFCs, digital lending platforms, fintechs, payment aggregators, payment service providers, crypto exchanges and VDA providers in India |
| Motivation | Unauthorised fund transfers and crypto wallet theft |
| Losses | CERT-In reports multiple cases running into crores of rupees, with no victims or total named |
| Status | Active and ongoing |
How did the Crafty Falcon campaign unfold?
The tools behind Crafty Falcon were in criminal and espionage use elsewhere for months before CERT-In named the Indian campaign.
| Date | Event |
|---|---|
| 08 Nov 2025 | CyberStrikeAI first published on GitHub by a developer known as Ed1s0nZ |
| Jan to Feb 2026 | Team Cymru finds CyberStrikeAI on 21 IPs, mostly in China, Singapore and Hong Kong, during an AI-assisted campaign that compromised 600+ FortiGate devices in 55 countries |
| Late Sep 2026 | ARTEX used against seven South Korean banks and lenders, exposing data on about 66,000 to 67,000 people and 2,200 corporates |
| 07 Oct 2026 | CrowdStrike publishes the ARTEX operator infrastructure and assesses a Chinese-speaking, financially motivated operator with moderate confidence |
| 08 to 09 Oct 2026 | Two Mumbai NBFCs lose about $2 million in 700+ unauthorised instant transfers from ICICI Bank accounts. A police complaint cited by Reuters says attackers compromised disbursal APIs |
| 09 Oct 2026 | CERT-In issues CIAD-2026-0046 on payment and disbursement API abuse |
| 17 Oct 2026 | China-nexus VAPOR PANDA begins an 11-day ARTEX campaign against 200+ organisations in 14 countries |
| 20 Oct 2026 | Norforge exposes open Cairn panels. The largest cluster, working in Chinese, ran 1,100+ attack projects against e-commerce and payment platforms |
| 04 Nov 2026 | CERT-In issues CIAD-2026-0058, names CRAFTY FALCON and rates it Critical |
CERT-In has not linked any named Indian incident to Crafty Falcon. The October NBFC losses fit the pattern, but treat them as context, not attribution.
Which AI tools does Crafty Falcon use?
CERT-In names four tool families. All four are public. None of them checks whether the person running it is authorised to test the target.
| Tool | What it is | China link | Seen elsewhere |
|---|---|---|---|
| ARTEX | Open-source multi-agent LLM pentest framework. Went closed source in October 2026 after misuse | Built by a Chinese security engineer, Li Puhua | South Korean bank breaches. VAPOR PANDA espionage across 200+ organisations |
| PentAGI | Autonomous multi-agent pentest system from VXControl, running 20+ tools such as nmap, Metasploit and sqlmap in a Docker sandbox | None reported | No public victim reporting before CERT-In |
| Cairn | AI state-space search engine. Coding agents work towards a set goal and share findings on a common board | Developer origin not reported. Largest abuse cluster works in Chinese | Three criminal clusters, one of which breached 100+ companies for web shell access |
| CyberStrikeAI | AI-native testing platform in Go with 100+ offensive tools built in | Developer Ed1s0nZ, China-based, with reported links to Knownsec 404 and the CNNVD | FortiGate mass compromise, early 2026 |
The exposed ARTEX operator servers from the South Korean campaign show how this tooling runs in practice. CrowdStrike and Hunt.io recovered a Claude Code agent routed through a third-party reseller to DeepSeek, with GLM and Grok as backups. They also found 19 custom agent skills. Several map straight onto what CERT-In describes in India: a payment-logic skill for testing cash-in flows, skills to download and decompile Android apps and mine them for internal API endpoints, and a WAF bypass skill. CERT-In has not confirmed that this operator is Crafty Falcon. The overlap in method is still worth noting.
How does a Crafty Falcon attack work, step by step?
CERT-In described the pattern across reported incidents. The order below is a ScruteX reading of that pattern.
- Recon. AI agents survey internet-facing hosts, APIs, JavaScript endpoints and mobile apps.
- Entry. The actor uses internet-facing UAT, staging and test environments as the way in. It exploits newly published file-upload and deserialisation flaws in PHP and Node.js apps as soon as they go public, and drops web shells.
- Pivot. It moves into production through credentials, tokens and network paths shared between non-production and production. It pulls hardcoded tokens from source and build code, and abuses AWS Systems Manager and Lambda to run commands inside normal cloud admin channels.
- Bypass. It reverse-engineers the client app and calls APIs from altered packages, which defeats any control that assumes only the genuine app calls the API. It routes traffic through whitelisted third-party fetcher IP pools, such as content-acceleration and app-store review fetchers, to get past IP allow-lists.
- Test. It sends a micro-value transfer, as low as ₹1, to confirm the fund flow works.
- Cash-out. It calls disbursement, payment and merchant settlement APIs to move real money. At crypto exchanges, it steals wallet keys and drains wallets.
- Return. It comes back to the same entity where the fix was incomplete, and times attacks for holidays, weekends and other low-monitoring windows.
The theft itself needs no malware. The transfer goes out through the victim's own API as a well-formed request.
What are the Crafty Falcon TTPs?
The technique IDs are the ScruteX mapping of behaviour CERT-In described. CERT-In did not publish ATT&CK IDs.
| Tactic | Technique | ID | How Crafty Falcon uses it |
|---|---|---|---|
| Resource development | Obtain Capabilities: Artificial Intelligence | T1588.007 | Runs ARTEX, PentAGI, Cairn and CyberStrikeAI |
| Reconnaissance | Active Scanning | T1595 | Surveys targets with machine intelligence before striking |
| Initial access | Exploit Public-Facing Application | T1190 | File-upload and deserialisation flaws in PHP and Node.js, exploited on publication |
| Persistence | Server Software Component: Web Shell | T1505.003 | Web shells in PHP and Node.js apps |
| Credential access | Unsecured Credentials: Credentials in Files | T1552.001 | Hardcoded tokens in source and build code |
| Lateral movement | Valid Accounts | T1078 | Shared credentials and tokens from UAT into production |
| Execution | Cloud Administration Command / Serverless Execution | T1651 / T1648 | AWS Systems Manager and Lambda |
| Defence evasion | Proxy | T1090 | Whitelisted third-party fetcher pools to bypass IP allow-lists |
| Command and control | Web Protocols | T1071.001 | Unrestricted HTTPS egress for C2 and exfiltration |
| Impact | Financial Theft | T1657 | Disbursement, payment and settlement APIs after ₹1 tests |
One behaviour has no clean ATT&CK fit: calling APIs from a repackaged app. The closest match is OWASP API6:2023, Unrestricted Access to Sensitive Business Flows. WAF and signature rules pass these requests, because each one is well formed.
Crafty Falcon IOCs
CERT-In shared the confirmed Crafty Falcon indicators only with BFSI entities, under restricted TLP. Regulated entities should request them through CSIRT-Fin.
The indicators below are public and belong to operators of the same AI tools, mainly the ARTEX operator behind the South Korean bank breaches. They are not CERT-In confirmed Crafty Falcon indicators. Block them, but do not treat a clean search as an all-clear. CERT-In notes that indicators rotate within hours to days while techniques stay the same.
Block first
| Indicator | Role |
|---|---|
38.244.50[.]120 | ARTEX console and jump host, AS174, Los Angeles |
23.248.226[.]250 | Hong Kong jump server, AS138415, with a staged JNDI and LDAP exploit rig |
154.201.79[.]246 | Rotating proxy gateway, 79 exit IPs across 100 sampled identities |
Proxy and operator IPs:
101.53.80[.]20, 205.214.59[.]31, 124.155.252[.]63, 23.248.249[.]90, 23.158.220[.]98, 103.248.148[.]84, 203.160.133[.]172, 209.209.85[.]38, 156.251.11[.]39, 130.94.31[.]86, 202.95.14[.]60, 212.129.221[.]26, 149.88.85[.]20, 118.107.47[.]11, 212.11.64[.]250 (aged, last seen January 2026)Abused services, not attacker-owned:
xcai[.]pro and direct[.]xcai[.]pro (unofficial LLM API reseller), fofoapi[.]com (unofficial front for the FOFA search API), u6ud2s[.]dnslog[.]cn (operator token on a public callback service)Hunting fingerprints: TLS certificate SHA-256
C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842 with issuer organisation "ARTEX". HTTP title ARTEX - 自主渗透测试控制台 and its translated variants. File artex_probe_11876.txt on a print$ share.The full block list, with device and control guidance per indicator, is available as a CSV: Crafty Falcon IOC block list.
How do you detect Crafty Falcon activity?
AI agents enumerate everything, retry fast and write fresh tooling for each target. That makes them noisy in places most teams do not log. Five hunts cover most of the chain:
- Test-then-drain. A transfer of ₹10 or less to a beneficiary first seen in the last 24 hours, followed within hours by a large transfer to the same or a linked beneficiary.
- Non-prod to prod. Any connection, API call or token use from a UAT, staging or test subnet into a production database, API or secret store.
- Cloud admin abuse.
ssm:StartSession,ssm:SendCommand,lambda:UpdateFunctionCodeor new IAM keys in production outside a change window. - Planted operator rig. Calls to LLM APIs or resellers from servers, or Claude Code, PentAGI or Cairn processes on non-developer hosts.
- AI-generated tooling. Five or more near-identical, heavily commented scripts appearing in a web root or temp path within an hour.
CERT-In also recommends decoys: a canary API key in a UAT config file, a decoy admin panel on a staging host. Autonomous agents try every path they find, so they touch decoys a human attacker would skip.
Key takeaways
- Crafty Falcon is a tooling problem more than a single group. Four public frameworks give any operator a full attack chain. ScruteX assesses with moderate confidence that more than one operator sits behind the name.
- Patching alone does not close it. CERT-In saw the same entities hit again after remediation, so controls must sit at the API and transaction layer.
- The ₹1 test followed by a large transfer to a new beneficiary is the one step every theft shares. It is the best tripwire you have.
- Exposed UAT and staging environments are the way in CERT-In describes. Keep a complete register of them, then remove or harden each one.
Are you exposed?
Five checks, all answerable from your own systems in under an hour:
- ☐ Can you reach any of your UAT, staging or test hosts from the public internet right now?
- ☐ Do any credentials, API keys or tokens work in both a non-production and a production environment?
- ☐ Does your payment or disbursement API accept a request from anything other than your signed, attested app?
- ☐ Do you allow-list a CDN, app-store review or other shared third-party IP range in front of a payment endpoint?
- ☐ Would a ₹1 transfer to a brand new beneficiary at 2 a.m. on a public holiday trigger a hold, or only a log line?
Treat any "yes" or "not sure" as a gap to close this week.
What Scrutex finds here
Scrutex discovers internet-facing hosts tied to your domains and flags the ones that look like UAT, staging, test or admin environments. It watches public code repositories, paste sites and leak channels for API keys and tokens that belong to you. It tracks new AI attack tooling, operator panels and actor chatter aimed at Indian BFSI, so a new framework shows up in your feed before it shows up in your logs.
What that looks like
On day one at an ASX-listed financial services client, Scrutex's first scan returned 30+ internet-facing assets against a 20-asset manual register. Nine were unknown, including a staging environment for a client-facing app. That is the exact entry point CERT-In describes for Crafty Falcon.
A finding of this type appears in this format:
Can an AI agent see your UAT and staging hosts?
Check your domain for exposed non-production hosts. Domain only. No signup, no agent. Findings start returning on the page as soon as you enter it.
If exposed hosts are your problem: Vulnerability Insights, which finds internet-facing staging, test and admin hosts you did not know about.
If leaked tokens are your problem: Data Exposure Insights, which watches code repositories and paste sites for your API keys and credentials.
Go deeper: EASM best practices for 2026, for building a complete external asset register.
Go sideways: How to find leaked credentials on the dark web, for the credential half of this attack chain.
FAQ
Q: What is Crafty Falcon?
A: Crafty Falcon is an AI-assisted financial threat actor that CSIRT-Fin under CERT-In named on 04 November 2026 in advisory CIAD-2026-0058. It targets Indian NBFCs, fintechs, payment aggregators and crypto exchanges, and steals funds by calling the victims' own payment and disbursement APIs.
Q: Is Crafty Falcon a Chinese hacking group?
A: CERT-In has not attributed Crafty Falcon to any country or sponsor. Researchers link two of its four tools, ARTEX and CyberStrikeAI, to China-based developers. Tool origin does not prove who runs the operation.
Q: Which AI tools does Crafty Falcon use?
A: CERT-In names four publicly available tools: the ARTEX family of LLM-based pentest tools, the PentAGI multi-agent pentest system, the Cairn attack search engine and the CyberStrikeAI framework. They run full attack chains and write tailored scripts at machine speed.
Q: Is Crafty Falcon still active?
A: Yes. CERT-In described the threat as active and ongoing on 04 November 2026, and said entities that had already remediated were attacked again.
Q: How can a bank or NBFC detect Crafty Falcon?
A: Watch for a ₹1 test transfer to a new beneficiary followed by a large transfer, any access from UAT or staging into production, and unexpected AWS Systems Manager or Lambda activity. Request the restricted indicators and detection rules from CSIRT-Fin.