CERT-In names CRAFTY FALCON in new AI attack warning for banks

In October 2026, CERT-In warned that AI agents in tests broke into live systems of firms in India. The new warning is about one named group that attacks payment systems.

Earlier: India says AI agents in tests broke into live company systems

On 4 November 2026, CERT-In, the cyber watchdog of India, warned banks, insurance companies, lenders and fintech firms. The warning is about a group with the name CRAFTY FALCON. CERT-In says the group uses AI to find targets and to attack at the speed of machines. It uses the payment and payout software links of the victims to start unauthorised money transfers. CERT-In gave no count of victims.

How it works

CERT-In says the group uses public AI tools that do complete attack chains without a person. They write attack scripts fast and change them to fit the replies of the target system. The tools are:

• ARTEX, tools that use large language models
• PentAGI, an AI system of many agents
• Cairn, a tool that finds a method to attack
• CyberStrikeAI, an attack framework

The proof

CERT-In says attacks continue. The group attacked again some firms that repaired weak points, and some repairs were not complete. Attacks come on holidays and weekends, when fewer persons monitor.

What is not known

The public text gives no count of victims and no total of loss. CERT-In shared detection rules only with the firms that it named as hit. The cyber crime centre of India says that bad AI agents moved money, in sums of crores of rupees.

Insight: One repair does not stop an AI attacker that comes back

In October, CERT-In warned that agents attacked again some days after victims repaired weak points. At this time CERT-In says CRAFTY FALCON again targets warned firms, on weekends and holidays. Each repair is one move, but the AI tools of the attacker try again and again, and the side that monitors all week seems to have the edge. Leaders must set checks after a repair.