India flags Chinese-linked AI tools in hacking campaign against financial firms

By Munsif Vengattil and Ashwin Manikandan

BENGALURU/MUMBAI, Nov 5 (Reuters) - India's cybersecurity agency named the hacking group behind a wave of AI-driven attacks on financial firms and identified its tools, at least two of them linked to China, adding India to a growing list of countries where such tools have been used against banks.

The group, which the Indian Computer Emergency Response Team (CERT-In) calls "Crafty Falcon," has breached non-bank lenders, fintech firms and cryptocurrency exchanges, according to an advisory issued on Wednesday.

CERT-In did not say who was behind the breaches or where the organisation operates.

The advisory came after a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, even as authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks.

CERT-In said the attackers use publicly available AI tools to automate break-ins "at machine speed," calling the threat "active and ongoing."

It named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China.

China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said.

It said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.

CERT-In did not name the affected companies or say how much money was stolen.

The agency did not say the attacks were state-sponsored and the tools it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked to the South Korean attacks.

CERT-In, the ​Indian Cybercrime Coordination Centre and India's IT ministry did not immediately respond to requests for comment.

PAYMENT INTERFACES TARGETED

CERT-In said Crafty Falcon "surveys its targets with machine intelligence" and moves money by invoking victims' own payment and disbursement systems.

Attacks were timed around holidays, weekends and other low-monitoring periods to delay detection. Firms that had fixed flaws after earlier alerts were attacked again after incomplete remediations were made, it said.

Reuters previously reported, citing a police complaint, that last month two Mumbai-based non-bank lenders lost about $2 million in more than 700 unauthorised instant transfers from accounts of India's third-largest lender ICICI Bank ICBK.NS on October 8 and 9.

The complaint said hackers compromised its ⁠application programming interfaces (APIs), the software links banks use to connect with non-bank lenders and fintech firms to send loan-disbursal instructions.

State Bank of India SBI.NS, the country's largest lender, disclosed a dark-web leak of 3,897 customer records last month. Spandana Sphoorty Financial SPAD.NS, a non-bank lender, reported unauthorised debits from a bank account on November 1, and AU Small Finance Bank AUFI.NS said it was probing a potential customer-data leak.

CERT-In did not say which incidents were linked to Crafty Falcon.