India's CERT-In Names AI Hacking Tools Used Against Lenders, Fintechs and Crypto Exchanges

The advisory from CERT-In, issued on Wednesday, identifies the tools as ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China, Reuters reported. The agency described the threat as "active and ongoing" and said the attackers were using publicly available AI tools to break into systems "at machine speed".

The warning moves AI-assisted hacking from a theoretical concern to a live problem for Indian financial firms. Tools of this kind pair large language models with network scanners and exploit kits, allowing a single operator to run reconnaissance and attacks across many targets quickly. Because the tools CERT-In named can be downloaded freely, defenders cannot rely on blocking a single actor or piece of software.

The advisory leaves important questions open. CERT-In did not say who is behind Crafty Falcon, where the group operates or whether it is backed by a state. It did not name the companies that were breached or say how much money was taken. CERT-In, the Indian Cybercrime Coordination Centre and India's IT ministry did not immediately respond to Reuters' requests for comment.

The most widely documented of the four tools is ARTEX. Cybersecurity company CrowdStrike has said the China-made tool has been used in attacks on South Korean banks since late September, and that a China-linked group also used it in an espionage campaign against more than 200 organisations in at least 14 countries. Its developer made the tool private last month after the South Korean attacks were tied to it.

In South Korea, seven financial firms, among them Shinhan Bank, KB Kookmin Bank, Hana Bank and Hyundai Capital, have reported breaches since late September that exposed data on more than 67,000 people, according to a tally by the security news site Ministry of Cyber Affairs. Korean officials have stressed that finding traces of ARTEX on a linked server does not by itself prove a Chinese origin, and no link between the Korean and Indian attackers has been established.

The new advisory follows a series of cyberattacks on Indian banks and non-bank lenders in recent weeks, after which the Reserve Bank of India tightened its cybersecurity checks. In an earlier alert on October 9, CERT-In and CSIRT-Fin, the financial sector's security team, warned that attackers were hijacking payment and disbursement APIs to move money out of institutions without triggering loan, KYC or beneficiary checks, then routing it through IMPS and NEFT transfers into mule accounts at several banks. That advisory said the attacks showed signs of AI-assisted offensive frameworks and that the time between a break-in and the first fraudulent transfer had shrunk significantly.

CERT-In's October guidance told lenders, payment firms and wallet operators to enforce multi-factor authentication on payment platforms and bank APIs, keep an inventory of their APIs and shut down unused ones, replace long-lived static tokens with per-session authentication, require maker-checker approval for payouts and keep logs for at least 180 days.