# CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods

> India's CERT-In (advisories CIAD-2026-0046 and CIAD-2026-0058) warns of an AI-assisted financial threat actor tracked as CRAFTY FALCON that targets Indian NBFCs, digital lending, fintech, payment, wallet, BFSI and crypto/VDASP entities. The actor invokes the victim's own payment and disbursement APIs via exposed applications and non-production environments, and times attacks for weekends, holidays and other low-monitoring windows.

- **Published:** 2026-11-06T01:43:17Z
- **Last reviewed:** 2026-11-06T01:43:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5362
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5362.png
- **ID:** TL-2026-5362
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** CRAFTY FALCON
- **Detections:** 9 (1 shown free below) · **IOCs:** 8 (2 shown free below)

## Description

CERT-In first warned on 9 October 2026 (CIAD-2026-0046) of attacks on NBFCs, digital lending platforms, payment service providers and wallet operators that exploit payment and disbursement APIs to facilitate unauthorised fund transfers through manipulation of payment workflows and weak access controls. CERT-In then updated the advisory (CIAD-2026-0058; the advisory page gives the update date as 4 November 2026, and press coverage appeared on 6 November 2026), naming the actor CRAFTY FALCON, rating the situation critical and describing an active, ongoing campaign by an AI-assisted actor operating at machine speed against BFSI entities.

According to the advisory and reporting, CRAFTY FALCON's primary pattern is to strike by invoking the victim's own payment and disbursement APIs. Initial access comes from internet-facing applications, exposed APIs and privileged endpoints, from internet-exposed non-production (test/development) environments that hold shared credentials, tokens and network paths, and from the rapid exploitation of newly published vulnerabilities. The actor also exploits cloud infrastructure (compute, serverless and management services), reverse-engineers application codebases to build tailored exploits, and bypasses IP allow-lists by routing through shared third-party fetcher pools. Victim applications are rewritten so they execute unauthorised API calls, abusing the legitimate application's trust to blend in and delay detection. Large numbers of AI-generated, functionally identical custom scripts are produced and refined in quick succession, and attacker infrastructure rotates IP addresses within hours to days.

Monetisation follows a test-then-scale pattern: micro-value test transactions (the advisory cites INR 1 transfers; The Register reports roughly USD 0.01) validate access before larger unauthorised payments are pushed through. Against cryptocurrency exchanges and virtual digital asset service providers the actor steals wallet keys and empties wallets. Some victims were re-compromised after incomplete remediation, and CERT-In advises assuming persistence after any incident. Attacks are deliberately timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.

Attribution is low confidence: the operators appear to be Chinese-speaking, based on tooling linked to previous Chinese-linked actors. The tools named by CERT-In are ARTEX (LLM-based agentic penetration-testing framework family), PentAGI (autonomous multi-agent AI penetration-testing system), Cairn (attack search engine) and the CyberStrikeAI framework. Independent public reporting shows these tools have also been abused by other actors in unrelated campaigns, so tooling alone is not a reliable attribution signal. No CVEs, CVSS scores or actor-specific network IOCs were published by CERT-In or in the source article.

CERT-In recommends heightened 24x7 monitoring with extra staffing in low-coverage periods, centralised cloud audit logging with real-time alerting, TLS inspection and flagging of self-signed certificates, monitoring for micro-value test transactions preceding high-value transfers, full isolation of non-production environments, server-side API validation with request signing (nonce/timestamp), certificate pinning and app attestation, identity-based controls in place of IP allow-listing, file-integrity monitoring of application directories, rapid patching SLAs for internet-facing applications, HSM/multi-signature storage of crypto keys, forensic verification and post-remediation threat hunting, credential rotation, and reporting to CERT-In (incident@cert-in.org.in) and I4C's Cyber Fraud Mitigation Centre.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.002 Tool
- T1587.004 Exploits
- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1565 Data Manipulation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CRAFTY FALCON Micro-Value Test Transaction Followed by High-Value Disbursement** (`TL-2026-5362-SPL-001`)

Detects the CRAFTY FALCON (CERT-In CIAD-2026-0058) test-then-scale monetisation pattern: an API client makes an INR 1 / ~USD 0.01 micro-value payment or disbursement call and then pushes a materially larger transfer through the victim's own payment API. Behaviour-first and tool-agnostic, so it holds even though the actor rotates IPs within hours and generates functionally identical AI-written scripts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1657, T1190, T1550.001
- **Data sources:** payments:payment:api:audit (index=payments), PaymentApiAudit_CL, payment_api audit log
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=payments sourcetype="payment:api:audit" earliest=-24h (endpoint="*disburse*" OR endpoint="*payout*" OR endpoint="*transfer*" OR endpoint="*withdraw*") status IN (200, 201, 202) ```TL-2026-5362 CRAFTY FALCON micro-value INR 1 test transaction then larger payment from the same API client```
| eval amount_num=tonumber(amount)
| eval micro_time=if(amount_num>0 AND amount_num<=1, _time, null()), large_time=if(amount_num>=1000, _time, null())
| stats min(micro_time) as first_micro max(large_time) as last_large count as txn_count max(amount_num) as max_amount dc(src_ip) as src_ip_count values(src_ip) as src_ips by api_client_id
| where isnotnull(first_micro) AND isnotnull(last_large) AND last_large>first_micro
| eval first_micro=strftime(first_micro, "%Y-%m-%d %H:%M:%S"), last_large=strftime(last_large, "%Y-%m-%d %H:%M:%S")
| table api_client_id first_micro last_large txn_count max_amount src_ip_count src_ips
````

### Microsoft KQL

```kql
PaymentApiAudit_CL
| where TimeGenerated > ago(24h)
| where endpoint_s has_any ("disburse", "payout", "transfer", "withdraw")
| where toint(status_d) in (200, 201, 202)
| summarize FirstMicro = minif(TimeGenerated, amount_d > 0 and amount_d <= 1),
            LastLarge = maxif(TimeGenerated, amount_d >= 1000),
            TxnCount = count(), MaxAmount = max(amount_d),
            SrcIpCount = dcount(src_ip_s), SrcIps = make_set(src_ip_s, 20)
    by api_client_id_s
| where isnotnull(FirstMicro) and isnotnull(LastLarge) and LastLarge > FirstMicro
| project api_client_id_s, FirstMicro, LastLarge, TxnCount, MaxAmount, SrcIpCount, SrcIps
```

### Sigma

```yaml
title: CRAFTY FALCON Micro-Value Test Payment via Payment or Disbursement API
id: 7c1e4a52-3b0d-4f6e-9a21-5d8b6c0f1a11
status: experimental
description: Single-event approximation of the CRAFTY FALCON test-then-scale pattern. Flags a successful micro-value (INR 1 / about USD 0.01) call to a payment, payout or disbursement endpoint. Pair with the SPL or KQL form of this detection (TL-2026-5362-SPL-001) to confirm escalation to a larger transfer from the same API client. Requires a custom payment API audit log mapping.
references:
    - https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058
    - https://www.theregister.com/security/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/5308000
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.impact
    - attack.t1657
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1550.001
logsource:
    category: application
    product: payment_api
    service: audit
detection:
    selection_endpoint:
        endpoint|contains:
            - 'disburse'
            - 'payout'
            - 'transfer'
            - 'withdraw'
    selection_status:
        status:
            - 200
            - 201
            - 202
    selection_micro_gt:
        amount|gt: 0
    selection_micro_lte:
        amount|lte: 1
    condition: selection_endpoint and selection_status and selection_micro_gt and selection_micro_lte
falsepositives:
    - Payment gateway onboarding, penny-drop bank account verification and synthetic health checks
level: medium

```

**Known false positives:**

- Penny-drop bank-account verification and beneficiary validation flows that legitimately send INR 1
- Synthetic monitoring or QA jobs exercising disbursement endpoints in production

**Tuning notes:** Index, sourcetype and field names (api_client_id, endpoint, amount, status, src_ip) are placeholders for your payment API audit log; map them to your schema. Raise or lower the 1000 INR escalation threshold per product. Exclude penny-drop verification client IDs via a lookup, and shorten the 24h window for high-volume tenants.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CRAFTY FALCON Off-Hours Burst of Successful Payment and Disbursement API Calls (locked: unlock with TL Creds)
- CRAFTY FALCON Key Vault Secret Enumeration From a Previously Unseen IP (locked: unlock with TL Creds)
- CRAFTY FALCON Related Infrastructure and Community Lookalike Domain Contact (locked: unlock with TL Creds)
- CRAFTY FALCON AI Pentest Tool or Scripted Client Hitting Payment Endpoints (locked: unlock with TL Creds)
- CRAFTY FALCON Payment Application Files Rewritten by Script Interpreter or Web Worker (locked: unlock with TL Creds)
- CRAFTY FALCON Self-Signed TLS Certificate on External Connection From Server Network (locked: unlock with TL Creds)
- CRAFTY FALCON Bulk Secret and Token Retrieval From Cloud Control Plane (locked: unlock with TL Creds)
- CRAFTY FALCON AI Pentest Framework Execution (ARTEX, PentAGI, Cairn, CyberStrikeAI) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 8)

Defanged, TLP:CLEAR.

- IP address: `38.244.50[.]120`
- Domain: `xcai[.]pro`

Full set of 8 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CERT-In Advisory CIAD-2026-0058 (update to CIAD-2026-0046): CRAFTY FALCON](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058)
- [Threat actor targets Indian fintechs on weekends when defenders aren't watching (The Register)](https://www.theregister.com/security/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/5308000)
- [CERT-In Warns NBFCs and Fintech Firms of Cyberattacks Targeting Fintech Payment Infrastructure (Digital Terminal)](https://digitalterminal.in/trending/cert-in-warns-nbfcs-and-fintech-firms-of-cyberattacks-targeting-fintech-payment-infrastructure)
- [ARTEX AI pentesting tool used in data theft campaign (The Hacker News)](https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html)
- [Chinese hackers use AI-powered ARTEX (The Hacker News)](https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html)
- [Open-source CyberStrikeAI deployed in FortiGate attacks (The Hacker News)](https://thehackernews.com/2026/03/open-source-cyberstrikeai-deployed-in.html)
- [Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree (Dark Reading)](https://darkreading.com/cyberattacks-data-breaches/hackers-abuse-ai-pen-test-tool-cairn)
- [India's CERT-In warns fintechs, NBFCs, payment providers of API attacks (NewsBytes)](https://www.newsbytesapp.com/news/science/indias-cert-in-warns-fintechs-nbfcs-payment-providers-of-api-attacks/tldr)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5362