CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.
Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools like ARTEX, PentAGI, Cairn, and CyberStrikeAI .
The agency said the attacks have also targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of keys and funds.
The update follows an October 2026 alert issued by CERT-In, which warned of multiple cyber attack campaigns targeting non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment service providers, and cryptocurrency wallet operators.
Threat actors have been observed exploiting internet-facing applications and exposed APIs and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, and then invoke fund-transfer APIs directly from within the entities' own allow-listed infrastructure.
This approach, CERT-In added, defeats application-level controls such as loan creation, KYC, sanction, beneficiary verification, balance sufficiency, and per-transaction limits.
The rapidly executed fraudulent transactions are designed to move funds to attacker-controlled mule accounts across multiple banks.
CERT-In also warned that attackers are targeting cloud infrastructure to execute commands and deploy malicious payloads, as well as publicly-accessible non-production environments to obtain shared credentials, tokens, or network paths, and then use them to pivot to production systems.
Other notable post-exploitation actions undertaken by the adversary are as follows - The development comes as CERT-In has published the Artificial Intelligence Security Auditing Guidelines, laying out specific requirements to ensure the The framework calls for testing an AI agent's documented identities, authorized objectives, approved tool use, permission boundaries, and its adherence to the principle of least privilege (PoLP).
It also requires AI agents to require human approval for consequential actions, while ensuring high-risk AI systems incorporate emergency interruption, credential revocation, and controls for preventing automatic restarts.
In addition, the attacks involve the operators taking steps to delete logs and tamper with endpoint security tools in an attempt to complicate detection and incident response efforts.
The modified version conceals a new routine that grants a root shell during an unauthenticated request to the login endpoint.
A compromised ARTEX instance holds its targets' unpatched findings, live credentials, captured sessions and network position.
What happened
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.
Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools like ARTEX, PentAGI, Cairn, and CyberStrikeAI .
The agency said the attacks have also targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of keys and funds.
What changed
The update follows an October 2026 alert issued by CERT-In, which warned of multiple cyber attack campaigns targeting non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment service providers, and cryptocurrency wallet operators.
Threat actors have been observed exploiting internet-facing applications and exposed APIs and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, and then invoke fund-transfer APIs directly from within the entities' own allow-listed infrastructure.
This approach, CERT-In added, defeats application-level controls such as loan creation, KYC, sanction, beneficiary verification, balance sufficiency, and per-transaction limits.
Who is affected
The rapidly executed fraudulent transactions are designed to move funds to attacker-controlled mule accounts across multiple banks.
CERT-In also warned that attackers are targeting cloud infrastructure to execute commands and deploy malicious payloads, as well as publicly-accessible non-production environments to obtain shared credentials, tokens, or network paths, and then use them to pivot to production systems.
Why it matters
Other notable post-exploitation actions undertaken by the adversary are as follows - The development comes as CERT-In has published the Artificial Intelligence Security Auditing Guidelines, laying out specific requirements to ensure the The framework calls for testing an AI agent's documented identities, authorized objectives, approved tool use, permission boundaries, and its adherence to the principle of least privilege (PoLP).
It also requires AI agents to require human approval for consequential actions, while ensuring high-risk AI systems incorporate emergency interruption, credential revocation, and controls for preventing automatic restarts.
Technical details
In addition, the attacks involve the operators taking steps to delete logs and tamper with endpoint security tools in an attempt to complicate detection and incident response efforts.
The modified version conceals a new routine that grants a root shell during an unauthenticated request to the login endpoint.
Response
A compromised ARTEX instance holds its targets' unpatched findings, live credentials, captured sessions and network position.
Attribution
The Hacker News: The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.