# CRAFTY FALCON

> As of 2026-11-11, CRAFTY FALCON is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel, apt. ATT&CK coverage spans 21 techniques across 11 tactics in 2 of 2 tracked threats. Most-observed techniques: T1059 (Command and Scripting Interpreter), T1190 (Exploit Public-Facing Application), T1588.002 (Tool).

- **Tracked threats:** 2
- **Categories:** THREAT_INTEL, APT
- **As of:** 2026-11-11

## ATT&CK techniques observed

21 techniques observed across 2 of 2 tracked threats. Tactics: Resource Development (4), Credential Access (3), Execution (3), Initial Access (3), Impact (2), Command and Control (1).

- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 2 of 2 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 2 of 2 tracked threats
- [T1588.002](https://intel.threadlinqs.com/technique/T1588.002) Tool — Resource Development — observed in 2 of 2 tracked threats
- [T1657](https://intel.threadlinqs.com/technique/T1657) Financial Theft — Impact — observed in 2 of 2 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1090](https://intel.threadlinqs.com/technique/T1090) Proxy — Command and Control — observed in 1 of 2 tracked threats
- [T1195.002](https://intel.threadlinqs.com/technique/T1195.002) Supply Chain Compromise — Initial Access — observed in 1 of 2 tracked threats
- [T1505.003](https://intel.threadlinqs.com/technique/T1505.003) Server Software Component: Web Shell — Persistence — observed in 1 of 2 tracked threats
- [T1528](https://intel.threadlinqs.com/technique/T1528) Steal Application Access Token — Credential Access — observed in 1 of 2 tracked threats
- [T1550.001](https://intel.threadlinqs.com/technique/T1550.001) Application Access Token — Lateral Movement — observed in 1 of 2 tracked threats
- [T1552](https://intel.threadlinqs.com/technique/T1552) Unsecured Credentials — Credential Access — observed in 1 of 2 tracked threats
- [T1552.001](https://intel.threadlinqs.com/technique/T1552.001) Unsecured Credentials — Credential Access — observed in 1 of 2 tracked threats
- [T1565](https://intel.threadlinqs.com/technique/T1565) Data Manipulation — Impact — observed in 1 of 2 tracked threats
- [T1583.003](https://intel.threadlinqs.com/technique/T1583.003) Virtual Private Server — Resource Development — observed in 1 of 2 tracked threats

## Tracked threats

- [CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)](https://intel.threadlinqs.com/threat/TL-2026-5759) — HIGH
- [CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods](https://intel.threadlinqs.com/threat/TL-2026-5362) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/CRAFTY%20FALCON