CERT-In Flags China-Linked AI Cyberattacks On Indian Banks: Hackers Exploit Holidays, Low-Monitoring Windows

(MENAFN- Live Mint) The Indian Computer Emergency Response Team (CERT-In), the country's cybersecurity agency, has issued a warning about a series of cyberattacks using AI technologies. The attacks could target financial institutions, including non-banking lenders (NBL), fintech firms and cryptocurrency exchanges.

The agency on Wednesday, November 4, highlighted a hacking group known as 'Crafty Falcon' and four AIs that are claimed to be used to automate attacks on financial institutions in India, Reuters reported.

The agency said the attacks are active and persistent, using AI tools publicly available on the internet to quickly exploit vulnerabilities in systems. CERT-In has identified four tools, at least two of which have been reportedly used by the Chinese government against financial institutions in India, while cybersecurity researchers have connected India with some of the tools identified by CERT-In.

CERT-In identifies 4 AI tools used in attacks

CERT-In says the group is developing machine intelligence to identify the targets and automate cyber intrusions. The agency identified four tools that played a part in the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI.

Cybersecurity firm CrowdStrike has previously reported that ARTEX, a China-developed tool, was used in attacks targeting South Korean banks since late September. The firm also linked the tool to a hacking group allegedly linked to China that was behind the espionage campaign against over 200 organisations in at least 14 countries.

CERT-In has not been able to identify the persons or entities behind Crafty Falcon. It also did not say whether the attacks were state-sponsored. All the tools it mentioned in its advisory were already on the Internet, but its developer made ARTEX private last month after allegations connected it to the South Korean attacks.

Also Read | Nothing's AI-native product set for December launch; CEO Carl Pei shares details Hackers exploit payment systems during low-monitoring periods

The attackers took advantage of existing payment and disbursement mechanisms of financial companies to transfer funds, CERT-In said. They reportedly operated during the weekends, holidays and times when organisations were less busy, with fewer employees on duty to check their systems.

The agency also warned that companies which had addressed vulnerabilities following earlier security alerts were targeted again when their fixes were incomplete. This means the attackers were trying to exploit the previously compromised security systems and take advantage of unrectified gaps.

The advisory follows a series of cyber incidents affecting financial institutions in India in recent weeks, which led to fresh concerns regarding banking interface security and digital payment systems.

Also Read | Moonshot AI launches Kimi K3.1 Pro with better coding skills, reduced cyber risk Recent cyberattacks raise concerns across India's financial sector

Reuters previously reported, citing a police complaint, that two Mumbai-based non-banking lenders lost approximately $2 million through more than 700 unauthorised instant transfers on October 8 and 9. The deals were handled through ICICI Bank, India's third-biggest bank.

The complaint alleges that hackers broke into application programming interfaces (APIs) that enable banks, lenders and fintech firms to communicate about payments and dispensing loans.

There have also been security incidents reported at other financial institutions. Last month, State Bank of India revealed a leak of 3,897 of its customer records on the dark web. Spandana Sphoorty Financial reported unauthorised debits from a bank account on November 1, while AU Small Finance Bank said it was investigating a potential customer-data leak.

This CERT-In warning marks the increasing threat of AI-powered hacking, especially for financial institutions with intricate payment ecosystems and digital infrastructure.

MENAFN05112026007365015876ID1111919790