MediumII Cyber Warfare & Critical Infrastructure4 November 2026, Wednesday
CERT-In declares Crafty Falcon an active threat to the financial sector
In advisory CIAD-2026-0058 dated 4 November, CERT-In, India's cyber incident response team, identified the previously undocumented Crafty Falcon group as an active threat targeting non-bank financial companies. The attackers make a 1-rupee test transaction before a large transfer.
According to Infosecurity Magazine, the group automates its attack chain with at least 4 AI-assisted penetration-testing tools: ARTEX, PentAGI, CyberStrikeAI and Cairn. The entry point is internet-facing test and staging environments. The attackers use shared credentials to move into production, then execute commands through 2 AWS services, Systems Manager and Lambda. Attacks are timed for 2-day weekends and holidays, when monitoring is weak.
According to the advisory, some organisations were attacked again because of incomplete remediation after 1 warning in early October that had only limited distribution. Targets include at least 4 types of institution: digital lending platforms, payment operators, fintechs and crypto exchanges; at the exchanges, wallet keys were stolen. CERT-In asked firms to flag large transfers that follow a 1-rupee test to a new payee and to impose a waiting period for new payees.
The insurance constraint: according to Infosecurity, most earlier campaigns using these tools were linked to China-based actors, but CERT-In made no state attribution in its 4 November advisory. The state-backed attack exclusion Lloyd's has required since 31 March 2023 can be triggered if attribution comes from the affected country's government. Separately, 1 organisation attacked again after incomplete remediation could face a negligence argument under its policy terms; this could not be verified.
Talay assessment
Bottom line
CERT-In's advisory puts a name and a technical signature to the attacks in I4C's 4 November warning; the problem is not an isolated fintech vulnerability but an automated, recurring campaign. While attribution remains unclear as of 4 November, losses stay insurable; if formal attribution to China follows, a debate over the state-backed attack exclusion begins.
Likely effects
- Indian fintechs and NBFCsNegativeWeeks
The cost of segregating test environments and monitoring around the clock weighs on the margins of small lending and payment firms.
- Cyber insuranceNegative1–6 months
Formal state attribution would bring the exclusion clause into dispute; incomplete remediation strengthens a negligence argument.
- Crypto exchangesUncertain1–6 months
The theft of wallet keys accelerates requirements for cold storage and hardware security modules.
Possibilities, ranked
- 1Campaign continues, regulation tightens55%
New losses are reported, and the RBI and CERT-In impose binding audit requirements on financial institutions.
Watch: An RBI cyber security circular to NBFCs
- 2Attacks recede30%
The recommended waiting periods and monitoring reduce losses.
Watch: November data from I4C's financial fraud reporting system
- 3Formal state attribution15%
India links the campaign to a state, and a debate over the insurance exclusion begins.
Watch: An Indian government attribution statement on Crafty Falcon
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Test transaction▼ 1 rupee
- AI tools named▼ 4
Sources
- Infosecurity Magazine — India Warns of New AI-Driven Cyber-Attacks Targeting Financial Sector (5 November 2026)
- Business Today — AI hackers use Rs 1 test transactions to move bigger sums from financial firms: CERT-In warns (5 November 2026)
- Clifford Chance — Lloyd's cyber war exclusion (September 2023)