CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5759 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CRAFTY FALCON - Web Server Process Spawning Shell (Web Shell / Exploited Upload or Deserialization Flaw)

Detects web server and PHP/Node.js runtime processes spawning command interpreters or LOLBins. CERT-In CIAD-2026-0058 reports CRAFTY FALCON planting web shells via newly disclosed file-upload (CWE-434) and deserialization (CWE-502) flaws in PHP and Node.js apps. Child-shell execution from the web tier is a high-fidelity post-exploitation signal (T1190, T1505.003, T1059).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003, T1059
• Data sources: sysmon, sysmon_for_linux, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\w3wp.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\php.exe" OR ParentImage="*\\node.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*/php-fpm*" OR ParentImage="*/nginx" OR ParentImage="*/apache2" OR ParentImage="*/httpd" OR ParentImage="*/node")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\whoami.exe" OR Image="*\\bitsadmin.exe" OR Image="*/sh" OR Image="*/bash" OR Image="*/dash")
| eval detection="TL-2026-5759 CRAFTY FALCON web shell or exploited PHP/Node.js app spawning a shell (T1190, T1505.003, T1059)"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by host ParentImage Image detection
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host ParentImage Image users command_lines count detection

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","php-cgi.exe","php.exe","php-fpm","php-fpm8","node.exe","node","nginx","nginx.exe","httpd","httpd.exe","apache2")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","whoami.exe","whoami","bitsadmin.exe","sh","bash","dash","curl","wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Web Server or Node.js Runtime Spawning Shell - CRAFTY FALCON Web Shell Activity
id: 7c1e4b52-8d3a-4f6e-9a10-5b2d7e3c1a01
status: experimental
description: Detects PHP/Node.js/IIS/nginx/Apache worker processes spawning command interpreters or LOLBins, consistent with web shells planted through file-upload or deserialization flaws as described in CERT-In CIAD-2026-0058 (CRAFTY FALCON).
references:
    - https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0058&pageid=PUBVLNOTES02
    - https://labs.cloudsecurityalliance.org/research/csa-research-note-crafty-falcon-autonomous-offensive-ai-fram/
    - https://cyble.com/blog/crafty-falcon-ai-assisted-financial-threat-actor/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\php-cgi.exe'
            - '\php.exe'
            - '\node.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '/php-fpm'
            - '/nginx'
            - '/apache2'
            - '/httpd'
            - '/node'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\whoami.exe'
            - '\bitsadmin.exe'
            - '/sh'
            - '/bash'
            - '/dash'
    condition: selection_parent and selection_child
falsepositives:
    - Node.js build tooling or deployment scripts that shell out on application hosts
    - Legitimate admin panels or cron-style PHP jobs that call system utilities
level: high

Known false positives:

• Node.js build/deploy scripts or CI agents running on application hosts
• Legitimate PHP admin tools calling system utilities (e.g. backup scripts)

Tuning notes: Allow-list known parent command lines (e.g. specific deploy scripts), exclude build servers, and scope to internet-facing web tiers and UAT/staging hosts. Sysmon for Linux events may use a different sourcetype in your deployment; adjust index/sourcetype accordingly. Pair with file-integrity monitoring on upload and deployment directories.

• 🔒 Backdoored / Unofficial ARTEX Docker Image or Repository Used (CRAFTY FALCON Tooling) · unlock with TL Creds
• 🔒 CRAFTY FALCON - New AWS IAM Principal, Access Key or Policy Attachment by Non-Automation Identity · unlock with TL Creds
• 🔒 Scripted LLM API Egress from Servers (AI-Assisted Offensive Framework Backend) · unlock with TL Creds
• 🔒 CRAFTY FALCON - Offensive AI Framework Execution (ARTEX, PentAGI, Cairn, CyberStrikeAI) · unlock with TL Creds
• 🔒 CRAFTY FALCON - Log Deletion and Security Tool Tampering (Anti-Forensics) · unlock with TL Creds
• 🔒 CRAFTY FALCON - Hard-Coded Credential and API Token Hunting in Files · unlock with TL Creds
• 🔒 CRAFTY FALCON - AWS SSM SendCommand / Lambda UpdateFunctionCode by Non-Pipeline Identity · unlock with TL Creds
• 🔒 CRAFTY FALCON - Rs 1 Micro-Transfer Followed by Large Transfer to Same Beneficiary · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5759.

Technical analysis

CERT-In advisory CIAD-2026-0058 (issued 2026-11-04, updated 2026-11-11; rated Critical by CERT-In) escalates an earlier advisory, CIAD-2026-0046 of 2026-10-09, on actors abusing payment and disbursement APIs in Indian BFSI entities. CERT-In's finance team CSIRT-Fin named the actor CRAFTY FALCON. The advisory states the campaign is active and ongoing, that entities which received the restricted TLP:AMBER advisories and remediated were re-targeted (including after incomplete remediation), and that attacks are timed for holidays, weekends and other low-monitoring windows. CERT-In does not attribute the actor or state the number of victims; the full IOCs, infrastructure fingerprints and detection rules are only in a restricted TLP-controlled version shared with BFSI entities.

Attack chain per CERT-In/CSA: (1) initial access through internet-exposed UAT/staging/test environments, exposed APIs and privileged endpoints, newly disclosed file-upload and deserialization flaws in PHP and Node.js applications that are used to plant web shells, long-lived hard-coded API tokens, plaintext credentials in configs/source/databases, services lacking MFA, stolen payment-gateway and partner-bank API credentials, and supply-chain compromise of source repositories through forged commits; (2) pivot to production via shared credentials, tokens or network paths, and execution through AWS Systems Manager and Lambda to run commands and deploy files inside legitimate management channels; (3) reverse-engineering of client applications and use of modified app packages to make unauthorized API calls that bypass controls assuming only the legitimate client calls them; (4) allow-list bypass by routing traffic through whitelisted third-party fetcher IP pools (e.g. content-acceleration and app-store review fetchers) that can be made to fetch arbitrary URLs; (5) validation with micro-value (Rs 1) test transfers followed by large transfers to mule accounts across multiple banks, including abuse of payment-aggregator merchant settlement APIs that skip loan creation, KYC, sanctions screening, beneficiary, balance and limit checks; crypto exchanges/VASPs lose wallet keys and funds; (6) anti-forensics: log deletion and tampering with endpoint security tools. Infrastructure IPs rotate within hours to days and large numbers of near-identical custom scripts are generated and refined rapidly, consistent with AI-assisted development.

Tooling named by CERT-In: ARTEX (agentic multi-agent offensive framework written in Go; main agent coordinates planner and worker agents over a shared graph; the public repo was withdrawn by its developer after misuse), PentAGI (VXControl autonomous multi-agent pentest system with 20+ tools), Cairn (agent harness / attack search engine posting findings to a shared board) and CyberStrikeAI (Go-based AI-native platform integrating 100+ security tools). Separately, Badbyte research reported that unofficial ARTEX copies on GitHub and Docker Hub (tomicdd/artex, congdonglinux/artex) are backdoored with a hidden verifyCaptcha() routine that runs input prefixed by a secret marker through 'sh -c' as root before any authentication; the image had ~9,000 downloads and 62 consoles served the backdoored build between 2026-11-02 and 2026-11-04 (26 US, 17 Hong Kong, 7 China) out of 1,645 ARTEX consoles. This is a risk to operators of the tool and is not shown to be part of the CRAFTY FALCON intrusions.

Attribution: CERT-In does not attribute CRAFTY FALCON. Business Standard reported that researchers link at least two of the tools to China, but the tooling is public and CSA warns against inferring actor links from shared open-source tooling; no public evidence ties CRAFTY FALCON to VAPOR PANDA, Storm-0940 or the separate Cairn clusters. Severity here is analyst-assigned HIGH (no CVSS; CERT-In rates the advisory Critical). Defensive priorities: separate non-production from production, server-side transaction validation with signed requests and mTLS instead of IP allow-lists, secrets scanning and short-lived tokens, CloudTrail alerting on SSM SendCommand/Lambda UpdateFunctionCode/new IAM principals, micro-transfer-then-large-transfer fraud rules, canary credentials, and heightened weekend/holiday monitoring.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1648 Serverless Execution; T1651 Cloud Administration Command

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Command and Control

T1090 Proxy

Persistence

T1505.003 Server Software Component: Web Shell

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1588.002 Obtain Capabilities: Tool; T1588.007 Obtain Capabilities: Artificial Intelligence

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Apply a fast patch SLA to internet-facing PHP and Node.js applications, prioritizing file-upload and deserialization flaws

Immediate actions

• Isolate suspicious hosts, preserve evidence and logs, rotate all credentials and report to CERT-In (incident@cert-in.org.in) / CSIRT-Fin
• Alert on any access from UAT/staging/test to production and remove internet exposure of non-production environments
• Alert in CloudTrail on Systems Manager sessions/SendCommand, Lambda UpdateFunctionCode in production, and creation of IAM users, roles or access keys
• Flag micro-value (e.g. Rs 1) transfers to new beneficiaries followed by high-value transfers; hold or review these flows
• Block and hunt for offensive AI frameworks (ARTEX, PentAGI, Cairn, CyberStrikeAI) and for LLM API traffic from servers or non-development hosts

Workarounds

• Use WAF virtual patching as an interim control
• Make deployment directories read-only for the runtime user and use file-integrity monitoring to detect web shells
• Do not run unvetted ARTEX copies; the unofficial Docker/GitHub copies are backdoored with an unauthenticated root shell

Longer-term hardening

• Replace IP allow-lists of shared third-party fetcher pools with mutual TLS, signed requests or scoped API keys
• Treat client apps as untrusted: validate every transaction server-side, sign requests with nonce and timestamp, use app attestation and certificate pinning
• Ban hard-coded secrets, run secret scanning in repos and CI/CD, use short-lived least-privilege tokens, enforce branch protection, commit signing and mandatory review
• Apply new-beneficiary cooling periods, velocity rules and maker-checker approval for merchant settlement instructions
• Store crypto wallet keys in HSM/cold custody with multi-signature withdrawals
• Deploy honeypots, decoy admin panels and canary credentials; adopt zero trust and default-deny egress
• Lower alert thresholds and increase staffing on weekends and holidays; verify eradication forensically after any incident

Affected and fixed versions

• Indian BFSI sector — NBFCs, digital lending platforms, fintechs, payment aggregators and PSPs, crypto exchanges/VASPs (payment and disbursement APIs, merchant settlement APIs, UAT/staging environments)

Timeline

• 2026-10-08 Backdoored ARTEX Docker image reportedly pushed to Docker Hub (derived by Badbyte: first backdoored instance appeared ~12 days later, around 2026-10-20); approximate date
• 2026-10-09 CERT-In issues advisory CIAD-2026-0046 on threat actors exploiting payment and disbursement APIs for unauthorized fund transfers in NBFCs, digital lenders, fintechs, payment providers and crypto wallet operators
• 2026-10-20 First backdoored ARTEX console instance observed in the wild; The Hacker News also reports on a separate Cairn campaign (per CSA)
• 2026-10-21 Microsoft reports Storm-0940's ARTEX-driven supply-chain compromise (per CSA; not linked to CRAFTY FALCON)
• 2026-10-28 Cloud Security Alliance publishes research note on multi-agent offensive frameworks CyberStrikeAI and ARTEX
• 2026-10-29 CrowdStrike reports the VAPOR PANDA ARTEX campaign (per CSA; no public link to CRAFTY FALCON)
• 2026-11-02 Start of 3-day window in which 62 internet-facing consoles served the backdoored ARTEX build (26 US, 17 Hong Kong, 7 China); window ends 2026-11-04
• 2026-11-04 CERT-In issues critical advisory CIAD-2026-0058 naming CRAFTY FALCON, via CSIRT-Fin; 1,645 hosts serving an ARTEX console counted the same day
• 2026-11-05 The Hacker News, Business Standard and the CSA research note publish coverage of the advisory and the ARTEX backdoor
• 2026-11-11 CIAD-2026-0058 updated by CERT-In; Cyble publishes its analysis of the advisory

Sources cited

• CERT-In Advisory CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON cert-in.org.in · Advisory · 2026-11-04
• CSA Research Note: Crafty Falcon - Weaponized Pentest Agents Hit the Financial Sector labs.cloudsecurityalliance.org · Research · 2026-11-05
• CSA Research Note: Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX labs.cloudsecurityalliance.org · Research · 2026-10-28
• PentAGI (VXControl) GitHub repository GitHub · Code repository
• CERT-In's CRAFTY FALCON Advisory: AI Is the Accelerant, Your Payment APIs Are the Target (Cyble) cyble.com · Blog · 2026-11-11
• The Hacker News: Backdoored Docker Image for ARTEX AI The Hacker News · News · 2026-11-05
• Business Standard: China-linked tools used in AI-driven cyberattacks on Indian financial firms business-standard.com · News · 2026-11-05
• YourStory: CERT-In warns NBFCs and fintech firms of AI-driven attacks yourstory.com · News
• Moneylife: Crafty Falcon cyber threat escalates as AI-driven attacks target banks, fintechs and NBFCs moneylife.in · News

More in threat intel

• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)
• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)

More from CRAFTY FALCON

• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors