India flags Chinese-linked AI tools in hacking campaign against financial firms

BENGALURU/MUMBAI: India's cybersecurity agency named the hacking group behind a wave of AI-driven attacks on financial firms and identified its tools, at least two of them linked to China, adding India to a growing list of countries where such tools have been used against banks.The group, which the Indian Computer Emergency Response Team (CERT-In) calls "Crafty Falcon," has breached non-bank lenders, fintech firms and cryptocurrency exchanges, according to an advisory issued on Wednesday (Nov 4).CERT-In did not say who was behind the breaches or where the organisation operates.The advisory came after a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, even as authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks. CERT-In said the attackers use publicly available AI tools to automate break-ins "at machine speed", calling the threat "active and ongoing".It named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China.China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said.It said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.CERT-In did not name the affected companies or say how much money was stolen.The agency did not say the attacks were state-sponsored and the tools it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked to the South Korean attacks.CERT-In, the ​Indian Cybercrime Coordination Centre and India's IT ministry did not immediately respond to requests for comment.PAYMENT INTERFACES TARGETEDCERT-In said Crafty Falcon "surveys its targets with machine intelligence" and moves money by invoking victims' own payment and disbursement systems.Attacks were timed around holidays, weekends and other low-monitoring periods to delay detection. Firms that had fixed flaws after earlier alerts were attacked again after incomplete remediations were made, it said.Reuters previously reported, citing a police complaint, that last month two Mumbai-based non-bank lenders lost about US$2 million in more than 700 unauthorised instant transfers from accounts of India's third-largest lender ICICI Bank on Oct 8 and 9.The complaint said hackers compromised its ⁠application programming interfaces (APIs), the software links banks use to connect with non-bank lenders and fintech firms to send loan-disbursal instructions.State Bank of India, the country's largest lender, disclosed a dark-web leak of 3,897 customer records last month. Spandana Sphoorty Financial, a non-bank lender, reported unauthorised debits from a bank account on Nov 1, and AU Small Finance Bank said it was probing a potential customer-data leak.CERT-In did not say which incidents were linked to Crafty Falcon.