---
title: "CERT-In names ‘CRAFTY FALCON’: NBFCs that remediated were attacked again"
summary: "What CERT-In’s advisory CIAD-2026-0058 of 4 November adds to its 9 October warning: the attacker’s name, four AI tools, ₹1 test transfers, and the controls it asks lenders for."
url: https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks
format: Note
desk: "Security"
area: "Threats & vulnerabilities"
region: India
published: 2026-11-05
facts_checked: 2026-11-05
author: TechBag (The TechBag Journal)
tags: ["CERT-In","CSIRT-Fin","CIAD-2026-0058","CIAD-2026-0046","CRAFTY FALCON","NBFC","fintech","payment aggregators","API security","disbursement API","AI offensive tools","PentAGI","CyberStrikeAI","BFSI"]
cover: https://www.thetechbag.com/blog/covers/cert-in-crafty-falcon-nbfc-payment-attacks.png
---

# CERT-In names ‘CRAFTY FALCON’: NBFCs that remediated were attacked again

*What CERT-In’s advisory CIAD-2026-0058 of 4 November adds to its 9 October warning: the attacker’s name, four AI tools, ₹1 test transfers, and the controls it asks lenders for.*

Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-05 · Facts checked 2026-11-05 · Canonical: https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks

CERT-In has named the attacker draining Indian lenders through their own payment APIs “CRAFTY FALCON”, and says it is still succeeding, including against NBFCs and fintechs that had received the earlier restricted warnings and had already remediated. The same entities were “deliberately re-targeted”, with attacks timed for “holidays, weekends and other low-monitoring windows”. Advisory CIAD-2026-0058, rated Critical, was issued on 4 November as an update to the 9 October advisory on payment and disbursement APIs.[1][3]

## What the update adds to the October advisory

In October CERT-In described the core trick: steal payment-gateway and partner-bank API credentials, then call the disbursal API from the lender’s own whitelisted servers, skipping loan creation, KYC and sanction checks, and send the money to mule accounts. It mentioned only the “possible use” of AI-assisted tools.[3] The November update goes further on four points:[1]

- **A name and a description.** CSIRT-Fin, CERT-In’s finance-sector team, calls CRAFTY FALCON “an AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs”.
- **The tools.** Four publicly available AI-driven offensive tools: the “ARTEX” family of LLM-based tools, the PentAGI multi-agent penetration-testing system, the Cairn attack search engine and the CyberStrikeAI framework.
- **More kinds of victim.** Payment aggregators and cryptocurrency exchanges now sit beside NBFCs, digital lenders and fintechs, with merchant settlement APIs abused and wallet keys stolen.
- **The test transfer.** “Micro-value test transactions (such as Rs. 1)” to check that a stolen payment route works before the large transfers.

## How an attack runs, step by step

**Figure: In through a test system, pose as the app, send ₹1, then the large transfers**

*The attack pattern in CERT-In advisory CIAD-2026-0058, severity Critical, issued 4 November 2026*

1. 01Enter by a side doorInternet-facing UAT, staging or test systems, or a flaw exploited as soon as it is published; then into production on shared credentials or tokens.
2. 02Hide in cloud toolsCloud management services such as AWS Systems Manager and Lambda run the attacker’s commands and files, blending in with normal admin traffic.
3. 03Pose as the appThe lender’s app is reverse-engineered and repackaged to call its APIs; requests route through trusted third-party fetcher IPs to pass the allow-list.
4. 04₹1 first, then the restA test payment to a new beneficiary proves the route; large transfers follow, often on a weekend or holiday.

Source: CERT-In, CIAD-2026-0058 · as of 4 November 2026

Two of these steps defeat controls lenders rely on. An API that trusts only the genuine app is open to anyone who rebuilds that app, so CERT-In asks for every transaction to be validated on the server, with signed requests and app attestation. And an IP allow-list that admits a shared pool, such as a content-acceleration or app-store review service, admits anyone who can make that service fetch a web address, which, the advisory notes, any internet user can.[1]

## Why lenders that remediated were hit again, and what CERT-In asks for

The advisory gives two reasons. Some remediation was incomplete, so CERT-In says to “assume persistence” after any incident and verify eradication forensically. And the attackers rotate their IP addresses “within hours to days”: blocking the indicators shared in October does not stop the same techniques arriving from new ones.[1] Among the controls it lists:

- 24x7 monitoring with more staff and lower alert thresholds on holidays and weekends.
- Test and staging systems cut off from production: no shared credentials, tokens, API keys, databases or network paths.
- Real-time alerts on cloud audit logs: remote commands, serverless code changes, new roles, users or access keys.
- Flag a micro-value payment to a new beneficiary followed by a large one, and hold or review it; cooling periods for new beneficiaries.
- Mutual TLS, signed requests or scoped keys instead of allow-listing shared third-party IP pools.
- Maker-checker approval and reconciliation for merchant settlement instructions sent through payment-aggregator APIs.

ReportedWhat the advisory does not say

It names no victim and gives no loss or incident count. Losses at small NBFCs were put at about ₹300 crore in two months by The Economic Times on 29 October, citing unnamed sources;[4] no regulator has confirmed that figure, as we set out in [our 1 November note](https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks). CERT-In asks victims to report to it and, for bulk fraudulent transactions, to the Indian Cybercrime Coordination Centre;[1] its 2022 Directions already require reporting within six hours of noticing an incident.[5]

The same shape appeared in France this week: Crédit Mutuel Arkéa says attackers moved [its own funds through a supplier’s platform](https://www.thetechbag.com/blog/credit-mutuel-arkea-own-funds-supplier-platform) to other banks.

How we did this

Figures as of 5 November 2026, 7pm IST

The attack pattern, tools and controls are CERT-In’s advisory of 4 November, read on CERT-In’s site and checked against the copy MediaNama published; “what the update adds” compares it with the public 9 October text only, not the restricted versions sent to lenders, which we have not seen. The ₹300 crore is reported, not confirmed.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CERT-In, CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor "CRAFTY FALCON"](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058) — 4 November 2026
2. [CERT-In, CIAD-2026-0058 (the same advisory, as a PDF copy hosted by MediaNama)](https://www.medianama.com/wp-content/uploads/2026/11/CERT-In-Advisory.pdf) — 4 November 2026
3. [CERT-In, CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0046) — 9 October 2026
4. [The Economic Times, AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months](https://economictimes.indiatimes.com/industry/banking/finance/ai-powered-cyberattacks-siphon-300-crore-from-small-nbfcs-in-two-months/articleshow/135278215.cms) — 29 October 2026
5. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, Annexure I)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [Two CERT-In advisories in six days: AI agents broke in, and no victim noticed](https://www.thetechbag.com/blog/cert-in-ai-agents-no-victim-noticed) — The advisory this one updates, read in full: what CIAD-2026-0046 and 0049 say, and the 104-minute LiteLLM poisoning that followed.

Go deeper on TechBag

- [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the six-hour reporting clocks a lender runs after an incident
- [Cloud workload security guide](https://www.thetechbag.com/browse/security/cloud-workload-security) — posture and runtime tools that watch cloud management and serverless changes
- [Privileged access management guide](https://www.thetechbag.com/browse/identity-access/privileged-access-management) — vaulting and rotating the API keys and tokens the attackers reuse