Executive Summary
CERT-In has identified an active threat actor known as Crafty Falcon targeting India's Banking, Financial Services, and Insurance (BFSI) sectors, as well as cryptocurrency exchanges. The adversary utilizes AI-driven offensive security tools—including ARTEX, PentAGI, Cairn, and CyberStrikeAI—to execute autonomous, machine-speed attack chains that adapt payloads based on target responses. This high-velocity approach allows the actor to bypass traditional transaction controls and rapidly rotate attack infrastructure.
Technically, the campaign involves exploiting internet-facing APIs, using stolen long-lived tokens, and compromising supply chains through forged commits in source code repositories. Notably, a backdoored version of the open-source tool ARTEX has been identified in the wild, which grants unauthenticated root access to the host server via a hidden function in the login handler. This allows the attacker to intercept live credentials and findings from the very security tools used by victims.
This threat is high-priority due to its direct impact on financial integrity, including the theft of digital assets and the manipulation of payment gateway APIs. The use of AI-assisted script generation significantly reduces the time between vulnerability discovery and exploitation, necessitating a move toward automated detection and robust API security governance.