India’s national cybersecurity agency has warned that an AI-assisted hacking campaign targeting cryptocurrency exchanges and other financial businesses is intensifying. The agency says attackers have stolen cryptocurrency wallet keys and siphoned funds, but has not named affected exchanges or disclosed the scale of losses.
The Indian Computer Emergency Response Team (CERT-In) identified the threat actor as “CRAFTY FALCON” in an updated advisory, expanding on a campaign it first warned about in October. Its latest notice specifically lists crypto exchanges among the targets. CERT-In said it continues to receive reports of successful attacks, including against nonbank financial companies and fintech firms that had received earlier restricted warnings and taken remedial steps.
The campaign has also targeted nonbank lenders, digital lending platforms, payment aggregators and service providers. According to CERT-In, attackers have exploited vulnerable applications and exposed testing environments, then used shared credentials and access tokens to reach production systems. They have also targeted cloud infrastructure to deploy malicious files.
CERT-In said AI tools enabled attackers to generate and refine scripts quickly, while reverse-engineering application code helped them develop tailored exploits. Some attacks were timed for weekends and holidays, when reduced coverage could delay detection. In certain cases, attackers made small test transactions before attempting larger unauthorized transfers.
The advisory describes the campaign as operating at “machine speed” and says it can invoke victims’ own payment and disbursement APIs. CERT-In urged at-risk organizations to treat the activity as active and escalating, monitor systems around the clock, and increase staffing and lower alert thresholds during weekends, holidays and other periods with limited coverage.
Sources: Cointelegraph.