CERT-In has warned Indian BFSI entities of a sophisticated AI-driven threat actor, 'CRAFTY FALCON'. This group leverages publicly available AI offensive tools like PentAGI and ARTEX to compromise payment and disbursement APIs. They've validated fund flows with micro-transactions, sometimes as low as Re 1, before executing larger transfers.
How We Got Here
CERT-In updated its advisory on November 4, building on an earlier alert from October 9 on payment API exploits. The agency's CSIRT-Fin identified CRAFTY FALCON as the architect behind these escalating attacks, specifically targeting cloud infrastructure.
The Numbers
- CRAFTY FALCON abuses AWS Systems Manager and Lambda to execute commands and deploy malicious files within cloud infrastructure.
- Attackers bypass IP allow-listing by routing traffic through shared third-party fetcher IP pools, including content-acceleration services.
- They exploit internet-exposed non-production environments like testing and staging to pivot to production via shared credentials.
- Attacks persist even after remediation, specifically targeting entities during weekends and holidays to maximize impact.
- Vulnerabilities in PHP and Node.js applications, especially file-upload and deserialization types, are actively targeted for rapid exploitation.
What Happens Next
🇮🇳 Why This Matters for India
For fintech founders in Hyderabad building payment infrastructure, this warning means a sudden tightening of compliance and a push for advanced API security features, potentially impacting Q1 2024 product roadmaps.
The Take
The winners here are API security startups offering real-time monitoring and server-side validation tools, while legacy BFSI systems that rely on basic IP allow-listing are the immediate losers. Expect multiple large banks to scramble for new vendors by EOY 2023, shifting substantial cybersecurity budgets.
Source:
MediaNama ↗