India’s national cybersecurity agency has warned that an active hacking campaign is targeting cryptocurrency exchanges alongside other financial businesses, with attackers using artificial intelligence tools to accelerate reconnaissance and adapt their methods. The alert says the activity has already led to stolen wallet keys and drained funds in some cases.
The Indian Computer Emergency Response Team, or CERT-In, said the threat actor it tracks as CRAFTY FALCON is behind the campaign. The latest notice updates an earlier warning issued in October and expands on how the group is operating, including the explicit identification of crypto exchanges among affected organizations.
CERT-In says campaign is still underway
CERT-In described the threat as active and ongoing, adding that CSIRT-Fin continues to receive reports of successful attacks. According to the agency, those reports include incidents involving nonbank financial companies and fintech entities that had previously received restricted advisories and had already taken remediation steps.
The warning indicates that the campaign is not limited to a single segment of the financial sector. Alongside crypto exchanges, the agency said the targets include nonbank lenders, digital lending platforms, fintech companies, payment aggregators and related service providers.
Attackers used exposed systems and internal access
The advisory says the attackers exploited vulnerable applications and exposed testing environments, then used shared credentials and access tokens to move from those environments into production systems. CERT-In also said cloud infrastructure was targeted for the deployment of malicious files.
In its description of the group’s methods, the agency said the attackers can survey targets with machine intelligence, operate at machine speed and abuse a victim’s own payment and disbursement APIs to execute attacks. That suggests the campaign relied not only on external vulnerabilities but also on weaknesses in operational controls and environment separation.
AI tools helped tailor and speed up intrusions
CERT-In said artificial intelligence tools were used to quickly generate and refine attack scripts. The agency also reported that the threat actor reverse-engineered application code to build tailored exploits against specific victims.
Some intrusions were reportedly timed for weekends and holidays, when security staffing may be thinner and response times slower. In certain cases, attackers first sent small test transactions to confirm that unauthorized transfers would succeed before attempting larger movements of funds.
Crypto losses reported, but scope remains unclear
Among the incidents cited by CERT-In were cases involving stolen cryptocurrency wallet keys and wallets that were subsequently drained. The agency did not identify any of the affected crypto exchanges, nor did it provide an estimate of financial losses linked to the campaign.
That leaves the scale of the impact unclear, even as the warning points to successful compromises across multiple parts of the financial industry. The absence of named victims also means the public record remains limited to the tactics and indicators described by the agency.
Next step is tighter monitoring and coverage
CERT-In advised organizations at risk to treat the campaign as escalating and to strengthen security monitoring on a 24/7 basis. It specifically urged increased staffing and lower alert thresholds during weekends, holidays and other periods when internal coverage is typically reduced.
For now, the agency’s latest advisory serves as the clearest confirmed update: CRAFTY FALCON remains active, crypto exchanges are among the targets, and the reported use of AI is helping attackers move faster through reconnaissance, exploitation and fund-transfer attempts.
Source: cointelegraph.com