I4C and CERT-In issue cyber attack warning for banks and fintech companies

The Indian Cyber Crime Coordination Centre (I4C), operating under the Ministry of Home Affairs, Government of India, and CERT-In, an agency of the Ministry of Electronics and Information Technology, have issued a serious warning to banks and fintech companies regarding AI-powered cyber attacks. According to a report, both agencies have issued a security advisory for banks, non-banking financial companies (NBFCs), fintech platforms, payment aggregators, and entities associated with payment gateways.

The advisory states that cybercriminals are now using AI agents to obtain financial gain. Due to the increasing use of digital banking and online payments in the country, fraudsters have adopted a new method of attack. Instead of traditional hacking, criminals are now targeting digital systems with the help of AI agents. Through this technology, system vulnerabilities can be identified at machine speed to carry out unauthorised transactions worth crores of rupees. In some cases, unauthorised transactions worth crores of rupees have emerged through fund disbursement systems and payment APIs.

According to sources in the investigating agency, 5,884 AI agents are remaining constantly live and targeting fintech companies, which has increased the concern of security agencies. However, an important clarification is necessary here that the official advisory of I4C does not mention the number 5,884 AI agents. Official documents have only confirmed the risk of automated cyber attacks by AI agents and unauthorised transactions worth crores of rupees.

On the other hand, data available on the AI Attacker Threat Research website shows that 5,884 IP addresses associated with cyber attacks have been identified. These IP addresses have been noted based on incident reports, independent analysis, and other technical evidence. It is estimated that this hosting network is spread across 60 countries of the world. According to these figures, 2,954 IP addresses have been recorded in Asia and 2,397 in North America. Nevertheless, this number of IP addresses cannot be directly counted as the number of active AI agents.

The method of attacks carried out by AI agents is different from traditional hacking. Criminals first search for vulnerabilities in the digital infrastructure of a bank or financial institution. Subsequently, an attempt is made to exploit these vulnerabilities with the help of AI-based tools and Agentic AI Framework. Many processes of the attack can be automated through this technology, making it possible to run a large number of digital activities in a very short time.

According to the official advisory, cybercriminals can carry out these attacks primarily in four stages. In the first stage, they target weak software and servers. In the second stage, an attempt is made to gain access to payment APIs and fund transfer systems. In the third stage, the unauthorisedly transferred amount is sent to different accounts through 'Mule Accounts'. In the final stage, they erase digital evidence to escape from investigating agencies.

Attackers specifically identify software, servers, and digital platforms that have not been updated on time. Due to incorrect configuration, the internet-connected servers and IT systems of many financial institutions remain weak. Criminals use these technical flaws to gain unauthorised entry into the system and once entry is gained, they find a way to reach other parts of the network.

Additionally, online interfaces created for recording customer complaints are also in the sights of cybercriminals. If the security of these platforms is weak, attackers may attempt to reach the company's internal digital network through them. In this way, an ordinary-looking online interface can also create a major risk for the entire financial system.