CERT-In flags China-Linked AI cyberattacks on Indian banks: Hackers exploit holidays, low-monitoring windows

CERT-In warned that a hacking campaign is using artificial intelligence to speed up attacks on financial institutions in India. The agency said the activity is active and persistent. It may affect non-banking lenders, fintech firms and cryptocurrency exchanges. The warning matters because financial companies depend on complex digital systems and payment connections.

The agency identified a group called Crafty Falcon and four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Attackers reportedly used existing payment and disbursement mechanisms to transfer funds. They also worked during weekends, holidays and quieter periods, when fewer employees were available to monitor systems.

CERT-In said attackers returned to companies that had previously fixed reported weaknesses, exploiting gaps left by incomplete fixes. The warning follows several incidents in India, including unauthorised transfers from two Mumbai-based lenders and reported customer-data exposure at other institutions. It highlights the need for stronger monitoring and complete vulnerability remediation.

Crafty Falcon is the name CERT-In gave to a hacking group involved in the reported campaign. The agency said the group is developing machine intelligence to identify targets and automate cyber intrusions. However, CERT-In has not identified the people or entities behind it. It also has not said whether the campaign is state-sponsored.

The China connection comes from the tools linked to the activity. CERT-In said at least two identified tools had reportedly been used by the Chinese government against financial institutions in India. CrowdStrike also reported that ARTEX, a China-developed tool, was used against South Korean banks and linked it to a China-associated hacking group involved in espionage against more than 200 organisations across 14 countries.

These links explain the China-linked description, but they do not prove Crafty Falcon is operated by China. The article states that researchers connected India with some identified tools, while the group’s identity remains unknown.

ARTEX, PentAGI, Cairn and CyberStrikeAI are four AI tools that CERT-In identified as part of the reported campaign. The article does not provide separate technical descriptions for each tool. It says all were already available on the internet, and that the attackers used AI to speed up attacks against financial institutions.

In practical terms, such tools can support cyberattacks by helping identify attractive targets, search for weaknesses and automate parts of an intrusion. CERT-In specifically said Crafty Falcon was developing machine intelligence to identify targets and automate cyber intrusions. The attackers also used existing payment and disbursement mechanisms to move funds after gaining access.

The tools therefore matter because automation can make attacks faster and more persistent. ARTEX was reportedly used against South Korean banks, according to CrowdStrike. Its developer made it private after allegations connected it to those attacks, but the other tools were identified as available online.

The reported impact includes financial losses, unauthorised transactions and exposed customer information. Two Mumbai-based non-banking lenders lost approximately $2 million through more than 700 unauthorised instant transfers on October 8 and 9. The transactions were handled through ICICI Bank, according to a police complaint cited by Reuters.

The reported incidents also involved data exposure. State Bank of India revealed that 3,897 customer records had appeared on the dark web. Spandana Sphoorty Financial reported unauthorised debits from a bank account on November 1, while AU Small Finance Bank investigated a potential customer-data leak.

These figures show different consequences from attacks on connected financial systems. Criminals may move money directly, cause unauthorised debits or expose customer records. The article does not provide one combined loss figure for every incident. It presents the $2 million and more than 700 transfers as the reported impact at the two Mumbai lenders.

An API is a digital connection that lets separate systems exchange instructions and information. In financial services, APIs can connect banks, lenders and fintech firms for activities such as payments and loan disbursements. If attackers break into those connections, they may manipulate requests or use legitimate processes for unauthorised transactions.

The article gives a concrete example from Mumbai. A police complaint alleged that hackers accessed APIs used by banks, lenders and fintech companies to communicate about payments and dispensing loans. Two non-banking lenders then lost approximately $2 million through more than 700 unauthorised instant transfers on October 8 and 9. The transactions were handled through ICICI Bank.

The danger is that an attack can exploit trusted connections rather than only targeting one visible website. Once an API or related system is compromised, attackers may use existing payment and disbursement mechanisms. This makes incomplete fixes especially risky, because remaining gaps can allow another intrusion.

CERT-In said the attackers operated during weekends, holidays and times when organisations were less busy. These periods often have fewer employees on duty to check systems. That creates an opportunity for suspicious activity to continue before someone notices, investigates or interrupts it.

The campaign reportedly used existing payment and disbursement mechanisms to transfer funds. If unusual requests arrive while monitoring teams are smaller, attackers may have more time to exploit a vulnerability or complete transactions. The reported Mumbai incidents involved more than 700 unauthorised instant transfers over October 8 and 9, although the article does not state that they occurred during a weekend or holiday.

Reduced monitoring does not create the vulnerability itself. It can increase the time available to exploit one. The warning therefore points to the importance of continuous oversight, especially for financial systems that operate digitally. CERT-In also cautioned that incomplete fixes could leave organisations exposed when attackers return.

In general, an API is a controlled way for software systems to exchange data and instructions. A lender can use one to communicate payment or loan-disbursement details to a bank or fintech platform. Automated software can then process the request, update records and move money without manual handling of every step. The article specifically describes APIs as enabling communication about payments and dispensing loans.

This interconnected setup improves speed, but it also creates more pathways into financial operations. If an attacker gains access to an API or related system, they may manipulate requests that appear to use normal payment processes. The Mumbai complaint alleged that hackers broke into APIs before more than 700 unauthorised instant transfers caused approximately $2 million in losses.

The risk grows when several organisations depend on the same digital links. A weakness in one connection can affect payments, lending or disbursement workflows beyond a single company. CERT-In’s warning shows why complete fixes and monitoring matter, especially when attackers use automation to find and exploit gaps.