Warning of China-linked AI cyber attacks on Indian banks and fintech companies

India's cyber security agency, CERT-In, has issued a serious warning regarding cyber attacks carried out using Artificial Intelligence (AI) technology. These attacks may target financial institutions such as banks, non-banking lenders (NBL), fintech companies, and cryptocurrency exchanges.

According to a Reuters report, the agency provided information on Wednesday, November 4, regarding a hacking group named 'Crafty Falcon' and four AI tools used to automate attacks on Indian financial institutions. According to CERT-In, these attacks are active and ongoing, utilizing AI tools available on the internet to rapidly exploit system vulnerabilities.

The agency has identified four tools: ARTEX, PentAGI, Cairn, and CyberStrikeAI. It is alleged that at least two of these tools have been used by the Chinese government against Indian financial institutions. Cyber security researchers have also linked some of these tools to India. CERT-In states that this group is developing machine intelligence to identify targets and automate cyber intrusions.

Cyber security firm CrowdStrike had previously reported that the China-developed ARTEX tool was used from the end of September to attack banks in South Korea. This tool was linked to a hacking group allegedly connected to China, which had conducted espionage campaigns against more than 200 organizations across 14 countries. The developer of ARTEX made the tool private last month.

CERT-In has not clarified which individual or organization is behind Crafty Falcon or whether these attacks are state-sponsored. The attackers transfer funds using the payment and disbursement mechanisms of financial companies. They become particularly active during weekends, holidays, and times when there are fewer employees in the office and monitoring is low.

The agency warned that companies that attempted to fix vulnerabilities following previous security warnings, but where the fixes remained incomplete, have been targeted again. Attackers were attempting to exploit previously compromised security systems and remaining flaws.

Recently, several cyber incidents have occurred in Indian financial institutions. According to the Reuters report, based on police complaints, it was revealed that two Mumbai-based non-banking lenders lost approximately 2 million dollars through more than 700 unauthorized instant transfers on October 8 and 9. These transactions were carried out via ICICI Bank. The complaint alleges that hackers infiltrated APIs, which enable banks, lenders, and fintech companies to communicate regarding payments and loans.

Apart from this, State Bank of India stated last month that records of 3,897 of its customers were leaked on the dark web. On November 1, unauthorized debits from bank accounts were reported by Spandana Sphoorti Financial, while AU Small Finance Bank mentioned conducting an investigation into the possibility of customer data leaks. According to a Mint report, this warning highlights the growing risk of AI-powered hacking for institutions with complex payment ecosystems.