Skip to navigation

Threat reportAPTTL-2026-5362

CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods

highACTIVE

India's CERT-In (advisories CIAD-2026-0046 and CIAD-2026-0058) warns of an AI-assisted financial threat actor tracked as CRAFTY FALCON that targets Indian NBFCs, digital lending, fintech, payment, wallet, BFSI and crypto/VDASP entities. The actor invokes the victim's own payment and disbursement APIs via exposed applications and non-production environments, and times attacks for weekends, holidays and other low-monitoring windows. First disclosed .

Key facts for CRAFTY FALCON fintech API abuse

IdentifiersTL-2026-5362
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsVarious Internet-facing fintech applications, payment/disbursement APIs and crypto wallet platforms in India
AttributionCRAFTY FALCON (low confidence)
ToolsARTEX, Cairn, CyberStrikeAI, PentAGI
MITRE ATT&CK techniquesT1036 Masquerading, T1059 Command and Scripting Interpreter, T1190 Exploit Public-Facing Application, T1528 Steal Application Access Token, T1550.001 Application Access Token, T1552 Unsecured Credentials, T1565 Data Manipulation, T1583.003 Virtual Private Server, T1587.004 Exploits, T1588.002 Tool, T1595.002 Vulnerability Scanning, T1657 Financial Theft
MotivationFINANCIAL
Target sectorsfinance, fintech, digital-lending, payments, insurance, cryptocurrency
Target regionsindia
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for CRAFTY FALCON fintech API abuse

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5362 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CRAFTY FALCON Micro-Value Test Transaction Followed by High-Value Disbursement

Detects the CRAFTY FALCON (CERT-In CIAD-2026-0058) test-then-scale monetisation pattern: an API client makes an INR 1 / ~USD 0.01 micro-value payment or disbursement call and then pushes a materially larger transfer through the victim's own payment API. Behaviour-first and tool-agnostic, so it holds even though the actor rotates IPs within hours and generates functionally identical AI-written scripts.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1657, T1190, T1550.001
  • Data sources: payments:payment:api:audit (index=payments), PaymentApiAudit_CL, payment_api audit log
  • Severity: high
  • Confidence: medium

Splunk SPL

index=payments sourcetype="payment:api:audit" earliest=-24h (endpoint="*disburse*" OR endpoint="*payout*" OR endpoint="*transfer*" OR endpoint="*withdraw*") status IN (200, 201, 202) ```TL-2026-5362 CRAFTY FALCON micro-value INR 1 test transaction then larger payment from the same API client```
| eval amount_num=tonumber(amount)
| eval micro_time=if(amount_num>0 AND amount_num<=1, _time, null()), large_time=if(amount_num>=1000, _time, null())
| stats min(micro_time) as first_micro max(large_time) as last_large count as txn_count max(amount_num) as max_amount dc(src_ip) as src_ip_count values(src_ip) as src_ips by api_client_id
| where isnotnull(first_micro) AND isnotnull(last_large) AND last_large>first_micro
| eval first_micro=strftime(first_micro, "%Y-%m-%d %H:%M:%S"), last_large=strftime(last_large, "%Y-%m-%d %H:%M:%S")
| table api_client_id first_micro last_large txn_count max_amount src_ip_count src_ips

Microsoft KQL

PaymentApiAudit_CL
| where TimeGenerated > ago(24h)
| where endpoint_s has_any ("disburse", "payout", "transfer", "withdraw")
| where toint(status_d) in (200, 201, 202)
| summarize FirstMicro = minif(TimeGenerated, amount_d > 0 and amount_d <= 1),
            LastLarge = maxif(TimeGenerated, amount_d >= 1000),
            TxnCount = count(), MaxAmount = max(amount_d),
            SrcIpCount = dcount(src_ip_s), SrcIps = make_set(src_ip_s, 20)
    by api_client_id_s
| where isnotnull(FirstMicro) and isnotnull(LastLarge) and LastLarge > FirstMicro
| project api_client_id_s, FirstMicro, LastLarge, TxnCount, MaxAmount, SrcIpCount, SrcIps

Sigma

title: CRAFTY FALCON Micro-Value Test Payment via Payment or Disbursement API
id: 7c1e4a52-3b0d-4f6e-9a21-5d8b6c0f1a11
status: experimental
description: Single-event approximation of the CRAFTY FALCON test-then-scale pattern. Flags a successful micro-value (INR 1 / about USD 0.01) call to a payment, payout or disbursement endpoint. Pair with the SPL or KQL form of this detection (TL-2026-5362-SPL-001) to confirm escalation to a larger transfer from the same API client. Requires a custom payment API audit log mapping.
references:
    - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058
    - https://www.theregister.com/security/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/5308000
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.impact
    - attack.t1657
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1550.001
logsource:
    category: application
    product: payment_api
    service: audit
detection:
    selection_endpoint:
        endpoint|contains:
            - 'disburse'
            - 'payout'
            - 'transfer'
            - 'withdraw'
    selection_status:
        status:
            - 200
            - 201
            - 202
    selection_micro_gt:
        amount|gt: 0
    selection_micro_lte:
        amount|lte: 1
    condition: selection_endpoint and selection_status and selection_micro_gt and selection_micro_lte
falsepositives:
    - Payment gateway onboarding, penny-drop bank account verification and synthetic health checks
level: medium

Known false positives:

  • Penny-drop bank-account verification and beneficiary validation flows that legitimately send INR 1
  • Synthetic monitoring or QA jobs exercising disbursement endpoints in production

Tuning notes: Index, sourcetype and field names (api_client_id, endpoint, amount, status, src_ip) are placeholders for your payment API audit log; map them to your schema. Raise or lower the 1000 INR escalation threshold per product. Exclude penny-drop verification client IDs via a lookup, and shorten the 24h window for high-volume tenants.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CRAFTY FALCON Off-Hours Burst of Successful Payment and Disbursement API Calls · unlock with TL Creds
  • CRAFTY FALCON Key Vault Secret Enumeration From a Previously Unseen IP · unlock with TL Creds
  • CRAFTY FALCON Related Infrastructure and Community Lookalike Domain Contact · unlock with TL Creds
  • CRAFTY FALCON AI Pentest Tool or Scripted Client Hitting Payment Endpoints · unlock with TL Creds
  • CRAFTY FALCON Payment Application Files Rewritten by Script Interpreter or Web Worker · unlock with TL Creds
  • CRAFTY FALCON Self-Signed TLS Certificate on External Connection From Server Network · unlock with TL Creds
  • CRAFTY FALCON Bulk Secret and Token Retrieval From Cloud Control Plane · unlock with TL Creds
  • CRAFTY FALCON AI Pentest Framework Execution (ARTEX, PentAGI, Cairn, CyberStrikeAI) · unlock with TL Creds

Indicators of compromise for CRAFTY FALCON fintech API abuse

As of 2026-11-06, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5362.

Sample indicators (2 of 8)

  • IP address: 38.244.50[.]120
  • Domain: xcai[.]pro

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

8 indicators of compromise · unlock with TL Creds. Compare plans

How CRAFTY FALCON fintech API abuse works

CERT-In first warned on 9 October 2026 (CIAD-2026-0046) of attacks on NBFCs, digital lending platforms, payment service providers and wallet operators that exploit payment and disbursement APIs to facilitate unauthorised fund transfers through manipulation of payment workflows and weak access controls. CERT-In then updated the advisory (CIAD-2026-0058; the advisory page gives the update date as 4 November 2026, and press coverage appeared on 6 November 2026), naming the actor CRAFTY FALCON, rating the situation critical and describing an active, ongoing campaign by an AI-assisted actor operating at machine speed against BFSI entities.

According to the advisory and reporting, CRAFTY FALCON's primary pattern is to strike by invoking the victim's own payment and disbursement APIs. Initial access comes from internet-facing applications, exposed APIs and privileged endpoints, from internet-exposed non-production (test/development) environments that hold shared credentials, tokens and network paths, and from the rapid exploitation of newly published vulnerabilities. The actor also exploits cloud infrastructure (compute, serverless and management services), reverse-engineers application codebases to build tailored exploits, and bypasses IP allow-lists by routing through shared third-party fetcher pools. Victim applications are rewritten so they execute unauthorised API calls, abusing the legitimate application's trust to blend in and delay detection. Large numbers of AI-generated, functionally identical custom scripts are produced and refined in quick succession, and attacker infrastructure rotates IP addresses within hours to days.

Monetisation follows a test-then-scale pattern: micro-value test transactions (the advisory cites INR 1 transfers; The Register reports roughly USD 0.01) validate access before larger unauthorised payments are pushed through. Against cryptocurrency exchanges and virtual digital asset service providers the actor steals wallet keys and empties wallets. Some victims were re-compromised after incomplete remediation, and CERT-In advises assuming persistence after any incident. Attacks are deliberately timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.

Attribution is low confidence: the operators appear to be Chinese-speaking, based on tooling linked to previous Chinese-linked actors. The tools named by CERT-In are ARTEX (LLM-based agentic penetration-testing framework family), PentAGI (autonomous multi-agent AI penetration-testing system), Cairn (attack search engine) and the CyberStrikeAI framework. Independent public reporting shows these tools have also been abused by other actors in unrelated campaigns, so tooling alone is not a reliable attribution signal. No CVEs, CVSS scores or actor-specific network IOCs were published by CERT-In or in the source article.

CERT-In recommends heightened 24x7 monitoring with extra staffing in low-coverage periods, centralised cloud audit logging with real-time alerting, TLS inspection and flagging of self-signed certificates, monitoring for micro-value test transactions preceding high-value transfers, full isolation of non-production environments, server-side API validation with request signing (nonce/timestamp), certificate pinning and app attestation, identity-based controls in place of IP allow-listing, file-integrity monitoring of application directories, rapid patching SLAs for internet-facing applications, HSM/multi-signature storage of crypto keys, forensic verification and post-remediation threat hunting, credential rotation, and reporting to CERT-In (incident@cert-in.org.in) and I4C's Cyber Fraud Mitigation Centre.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

lateral-movement

T1550.001 Application Access Token

Impact

T1565 Data Manipulation; T1657 Financial Theft

Resource Development

T1583.003 Virtual Private Server; T1587.004 Exploits; T1588.002 Tool

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for CRAFTY FALCON fintech API abuse

Patches

  • Establish rapid patching SLAs and apply vendor patches promptly for internet-facing applications, since the actor exploits newly published vulnerabilities immediately

Immediate actions

  • Enable 24x7 monitoring and real-time anomaly detection on payment, disbursement and wallet APIs, with increased staffed coverage over weekends and holidays
  • Isolate test and development (non-production) environments from the internet and from production, and remove any shared credentials, tokens or network paths they hold
  • Alert on micro-value test transactions (INR 1 / about USD 0.01) followed by escalating transfer values from the same account or API client
  • Rotate credentials, API tokens and wallet keys exposed through internet-facing or non-production environments
  • Assume persistence after any incident: perform forensic verification and report to CERT-In (incident@cert-in.org.in) and I4C's Cyber Fraud Mitigation Centre

Workarounds

  • Restrict access to cloud resources and privileged endpoints
  • Apply file-integrity monitoring to application directories to detect rewritten applications issuing unauthorised API calls

Longer-term hardening

  • Enforce transaction-level authorisation and strong authentication on all payment and disbursement APIs
  • Enforce server-side API validation with request signing (nonce/timestamp); add certificate pinning and app attestation
  • Replace IP allow-listing with identity-based controls (allow-lists can be bypassed via shared third-party fetcher pools)
  • Deploy API observability tooling and baseline normal API call patterns
  • Enable centralised cloud audit logging with real-time alerting; deploy TLS inspection and flag self-signed certificates
  • Store cryptocurrency keys in HSMs with multi-signature requirements
  • Review and scrutinise third-party integrations; run regular security assessments and post-remediation threat hunting
  • Coordinate product, engineering and payment operations teams on security controls as services change

Affected and fixed versions

  • Various — Internet-facing fintech applications, payment/disbursement APIs and crypto wallet platforms in India
    Vulnerable versions: Exposed APIs, privileged endpoints and internet-reachable test/development environments

Timeline of CRAFTY FALCON fintech API abuse

  • Start of the window in which locked-ioc-2, one of the tools named in the CRAFTY FALCON reporting, was observed abused by other actors against FortiGate appliances (context for the tooling, not attributed to CRAFTY FALCON)
  • End of the observed locked-ioc-2 FortiGate abuse window (over 600 appliances in 55 countries, other actors)
  • locked-ioc-7 developer states the tool was abused by malicious actors and converts the project to closed source (separate South Korean financial-sector campaign)
  • CERT-In issues CIAD-2026-0046 warning NBFCs, digital lending platforms, payment service providers and wallet operators of attacks exploiting payment and disbursement APIs for unauthorised fund transfers via workflow manipulation and weak access controls
  • CERT-In publishes the update CIAD-2026-0058 (advisory page date), naming CRAFTY FALCON, rating it critical and listing locked-ioc-7, locked-ioc-6, locked-ioc-8 and locked-ioc-2 as tooling; describes AI-generated scripts, rotating IPs and micro-value test transactions
  • The Register reports the CRAFTY FALCON update, including re-targeting of victims after incomplete remediation, wallet key theft from crypto platforms and low-confidence Chinese-speaking attribution

Sources cited for CRAFTY FALCON fintech API abuse

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats