India’s cybersecurity agency has named the hacking group behind a wave of AI-driven attacks on the country’s financial firms, identifying the tools used to automate break-ins at what it called “machine speed”.
The Indian Computer Emergency Response Team (CERT-In) said the group, which it calls “Crafty Falcon”, has breached non-bank lenders, financial technology firms and cryptocurrency exchanges, according to an advisory issued on Wednesday.
The agency said the attackers use publicly available artificial intelligence tools to automate break-ins, calling the threat “active and ongoing”. It named four tools — ARTEX, PentAGI, Cairn and CyberStrikeAI — and said security researchers have linked at least two of them to China.
CERT-In did not say who was behind the breaches or where the group operates, and it did not describe the attacks as state-sponsored. The tools it named are freely available online, although ARTEX was made private by its developer last month after it was linked to attacks in South Korea.
China-made ARTEX has been used in attacks on South Korean banks since late September, according to cybersecurity firm CrowdStrike, which said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.
The advisory follows a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks. The Reserve Bank of India has tightened cybersecurity checks, and authorities have issued a series of warnings to the sector.
According to CERT-In, Crafty Falcon “surveys its targets with machine intelligence” and moves stolen money by invoking victims’ own payment and disbursement systems. Attacks were timed around holidays, weekends and other low-monitoring periods to delay detection, and firms that had fixed flaws after earlier alerts were attacked again after incomplete repairs, the agency said.
CERT-In did not name the affected companies or say how much money was stolen, and it did not say which recent incidents were linked to Crafty Falcon.
Reuters previously reported, citing a police complaint, that two Mumbai-based non-bank lenders lost about $2 million in more than 700 unauthorised instant transfers from accounts at ICICI Bank, India’s third-largest lender, on 8 and 9 October. The complaint said hackers compromised the lenders’ application programming interfaces — the software links banks use to connect with non-bank lenders and fintech firms to send loan-disbursal instructions.
Separately, State Bank of India, the country’s largest lender, disclosed a dark-web leak of 3,897 customer records last month. Spandana Sphoorty Financial, a non-bank lender, reported unauthorised debits from a bank account on 1 November, and AU Small Finance Bank said it was probing a potential customer-data leak.
The episode adds India to a growing list of countries where AI tools have been turned against banks, and underlines how quickly publicly available AI software is being weaponised by financially motivated attackers.
Note on sourcing: this story is single-sourced to Reuters’ reporting of the CERT-In advisory. CERT-In has not attributed the attacks to any state, and the China link rests on security researchers’ findings about the tools, not on the agency’s advisory.
Sources: Reuters — “India flags Chinese-linked AI tools in hacking campaign against financial firms” (https://www.reuters.com/legal/government/india-flags-chinese-linked-ai-tools-hacking-campaign-against-financial-firms-2026-11-05/)
