India's Cybersecurity Agency Issues Warning on AI-Driven Hacks Targeting Financial Firms and Exchanges

India's Cybersecurity Warning

India's national cybersecurity agency has issued a stark warning regarding an escalating hacking campaign powered by artificial intelligence, which specifically targets cryptocurrency exchanges and various financial institutions. The Indian Computer Emergency Response Team (CERT-In) classified the malicious entity as "CRAFTY FALCON" during their announcement on Wednesday, highlighting the severity of the ongoing threat that was initially brought to light in October of this year.

Ongoing Assault on Crypto Platforms

The recent alert emphasizes the ongoing assault on crypto platforms, outlining how the attackers are using AI tools to enhance their operations, thereby increasing the sophistication and success rate of their intrusions. CERT-In noted,

"The danger persists and is intensifying. Our Cyber Security Incident Response Team for Finance (CSIRT-Fin) continues to receive reports of breaches, including from non-banking financial companies and fintech organizations that acted on previous warnings but still faced attacks."

AI in Cyber Attacks

Security experts have observed a concerning trend related to the application of AI in cyber attacks, as a previous October report from CrowdStrike revealed that unidentified malicious actors utilized an AI penetration-testing tool known as ARTEX, along with other AI frameworks, to infiltrate South Korean financial firms and extract sensitive data.

Attack Methods and Targets

CERT-In has described how the hackers meticulously survey their targets using machine intelligence and execute attacks at incredible speeds by exploiting the victim's own payment systems and APIs. A wide range of businesses, including non-bank lenders, digital lending companies, payment processors, and of course, cryptocurrency exchanges, have been subjected to these aggressive tactics.

The attackers have reportedly taken advantage of vulnerabilities in applications and insecure testing environments, often employing shared credentials and access tokens to infiltrate operational systems. Additionally, their efforts extend to targeting cloud infrastructures to introduce malicious files. AI technologies have empowered these attackers to rapidly create and enhance attack scripts, and they have also engaged in reverse engineering application code to create custom exploits. Notably, many of these strikes have occurred during weekends and holidays, aiming to minimize the likelihood of detection.

Impact and Recommendations

Some incidents have seen attackers conduct small test transactions to verify their unauthorized transfers before proceeding to siphon off significant amounts. CERT-In also highlighted instances of stolen wallet keys and drained cryptocurrency from various accounts. However, the agency refrained from naming specific crypto exchanges or sharing estimates regarding financial losses.

In light of this increasing threat, CERT-In has advised all potentially at-risk entities to remain vigilant, enhance their security measures, and maintain constant monitoring—particularly during periods of low staff coverage such as holidays and weekends. The need for enhanced defensive capabilities was echoed by Michael Coates, the chief information security officer at the Solana Foundation, who stressed that security teams must access top-tier AI tools to protect against these advanced attacks. Similarly, Ari Redbord, head of policy at TRM Labs, urged that ongoing security evaluations are critical, as attackers’ tactics evolve rapidly and outpace static audit methods.