# CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)

> CERT-In (via CSIRT-Fin) advisory CIAD-2026-0058 names CRAFTY FALCON, an active AI-assisted financial threat actor that attacks Indian NBFCs, digital lenders, fintechs, payment aggregators/PSPs and crypto exchanges by calling victims' own payment and disbursement APIs. The actor uses publicly available offensive AI frameworks (ARTEX, PentAGI, Cairn, CyberStrikeAI), pivots from exposed UAT/staging into production, cashes out to mule accounts after Rs 1 test transfers, and re-targets victims after incomplete remediation.

- **Published:** 2026-11-11T12:21:49Z
- **Last reviewed:** 2026-11-11T12:21:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5759
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5759.png
- **ID:** TL-2026-5759
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** CRAFTY FALCON
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

CERT-In advisory CIAD-2026-0058 (issued 2026-11-04, updated 2026-11-11; rated Critical by CERT-In) escalates an earlier advisory, CIAD-2026-0046 of 2026-10-09, on actors abusing payment and disbursement APIs in Indian BFSI entities. CERT-In's finance team CSIRT-Fin named the actor CRAFTY FALCON. The advisory states the campaign is active and ongoing, that entities which received the restricted TLP:AMBER advisories and remediated were re-targeted (including after incomplete remediation), and that attacks are timed for holidays, weekends and other low-monitoring windows. CERT-In does not attribute the actor or state the number of victims; the full IOCs, infrastructure fingerprints and detection rules are only in a restricted TLP-controlled version shared with BFSI entities.

Attack chain per CERT-In/CSA: (1) initial access through internet-exposed UAT/staging/test environments, exposed APIs and privileged endpoints, newly disclosed file-upload and deserialization flaws in PHP and Node.js applications that are used to plant web shells, long-lived hard-coded API tokens, plaintext credentials in configs/source/databases, services lacking MFA, stolen payment-gateway and partner-bank API credentials, and supply-chain compromise of source repositories through forged commits; (2) pivot to production via shared credentials, tokens or network paths, and execution through AWS Systems Manager and Lambda to run commands and deploy files inside legitimate management channels; (3) reverse-engineering of client applications and use of modified app packages to make unauthorized API calls that bypass controls assuming only the legitimate client calls them; (4) allow-list bypass by routing traffic through whitelisted third-party fetcher IP pools (e.g. content-acceleration and app-store review fetchers) that can be made to fetch arbitrary URLs; (5) validation with micro-value (Rs 1) test transfers followed by large transfers to mule accounts across multiple banks, including abuse of payment-aggregator merchant settlement APIs that skip loan creation, KYC, sanctions screening, beneficiary, balance and limit checks; crypto exchanges/VASPs lose wallet keys and funds; (6) anti-forensics: log deletion and tampering with endpoint security tools. Infrastructure IPs rotate within hours to days and large numbers of near-identical custom scripts are generated and refined rapidly, consistent with AI-assisted development.

Tooling named by CERT-In: ARTEX (agentic multi-agent offensive framework written in Go; main agent coordinates planner and worker agents over a shared graph; the public repo was withdrawn by its developer after misuse), PentAGI (VXControl autonomous multi-agent pentest system with 20+ tools), Cairn (agent harness / attack search engine posting findings to a shared board) and CyberStrikeAI (Go-based AI-native platform integrating 100+ security tools). Separately, Badbyte research reported that unofficial ARTEX copies on GitHub and Docker Hub (tomicdd/artex, congdonglinux/artex) are backdoored with a hidden verifyCaptcha() routine that runs input prefixed by a secret marker through 'sh -c' as root before any authentication; the image had ~9,000 downloads and 62 consoles served the backdoored build between 2026-11-02 and 2026-11-04 (26 US, 17 Hong Kong, 7 China) out of 1,645 ARTEX consoles. This is a risk to operators of the tool and is not shown to be part of the CRAFTY FALCON intrusions.

Attribution: CERT-In does not attribute CRAFTY FALCON. Business Standard reported that researchers link at least two of the tools to China, but the tooling is public and CSA warns against inferring actor links from shared open-source tooling; no public evidence ties CRAFTY FALCON to VAPOR PANDA, Storm-0940 or the separate Cairn clusters. Severity here is analyst-assigned HIGH (no CVSS; CERT-In rates the advisory Critical). Defensive priorities: separate non-production from production, server-side transaction validation with signed requests and mTLS instead of IP allow-lists, secrets scanning and short-lived tokens, CloudTrail alerting on SSM SendCommand/Lambda UpdateFunctionCode/new IAM principals, micro-transfer-then-large-transfer fraud rules, canary credentials, and heightened weekend/holiday monitoring.

## MITRE ATT&CK

- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1588.002 Obtain Capabilities: Tool
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059 Command and Scripting Interpreter
- T1651 Cloud Administration Command
- T1648 Serverless Execution
- T1505.003 Server Software Component: Web Shell
- T1685 Disable or Modify Tools
- T1552.001 Unsecured Credentials: Credentials In Files
- T1090 Proxy
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CRAFTY FALCON - Web Server Process Spawning Shell (Web Shell / Exploited Upload or Deserialization Flaw)** (`TL-2026-5759-SPL-001`)

Detects web server and PHP/Node.js runtime processes spawning command interpreters or LOLBins. CERT-In CIAD-2026-0058 reports CRAFTY FALCON planting web shells via newly disclosed file-upload (CWE-434) and deserialization (CWE-502) flaws in PHP and Node.js apps. Child-shell execution from the web tier is a high-fidelity post-exploitation signal (T1190, T1505.003, T1059).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003, T1059
- **Data sources:** sysmon, sysmon_for_linux, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (ParentImage="*\\w3wp.exe" OR ParentImage="*\\php-cgi.exe" OR ParentImage="*\\php.exe" OR ParentImage="*\\node.exe" OR ParentImage="*\\httpd.exe" OR ParentImage="*\\nginx.exe" OR ParentImage="*/php-fpm*" OR ParentImage="*/nginx" OR ParentImage="*/apache2" OR ParentImage="*/httpd" OR ParentImage="*/node")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\whoami.exe" OR Image="*\\bitsadmin.exe" OR Image="*/sh" OR Image="*/bash" OR Image="*/dash")
| eval detection="TL-2026-5759 CRAFTY FALCON web shell or exploited PHP/Node.js app spawning a shell (T1190, T1505.003, T1059)"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(User) as users by host ParentImage Image detection
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host ParentImage Image users command_lines count detection
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe","php-cgi.exe","php.exe","php-fpm","php-fpm8","node.exe","node","nginx","nginx.exe","httpd","httpd.exe","apache2")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","whoami.exe","whoami","bitsadmin.exe","sh","bash","dash","curl","wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Web Server or Node.js Runtime Spawning Shell - CRAFTY FALCON Web Shell Activity
id: 7c1e4b52-8d3a-4f6e-9a10-5b2d7e3c1a01
status: experimental
description: Detects PHP/Node.js/IIS/nginx/Apache worker processes spawning command interpreters or LOLBins, consistent with web shells planted through file-upload or deserialization flaws as described in CERT-In CIAD-2026-0058 (CRAFTY FALCON).
references:
    - https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0058&pageid=PUBVLNOTES02
    - https://labs.cloudsecurityalliance.org/research/csa-research-note-crafty-falcon-autonomous-offensive-ai-fram/
    - https://cyble.com/blog/crafty-falcon-ai-assisted-financial-threat-actor/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\php-cgi.exe'
            - '\php.exe'
            - '\node.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '/php-fpm'
            - '/nginx'
            - '/apache2'
            - '/httpd'
            - '/node'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\whoami.exe'
            - '\bitsadmin.exe'
            - '/sh'
            - '/bash'
            - '/dash'
    condition: selection_parent and selection_child
falsepositives:
    - Node.js build tooling or deployment scripts that shell out on application hosts
    - Legitimate admin panels or cron-style PHP jobs that call system utilities
level: high

```

**Known false positives:**

- Node.js build/deploy scripts or CI agents running on application hosts
- Legitimate PHP admin tools calling system utilities (e.g. backup scripts)

**Tuning notes:** Allow-list known parent command lines (e.g. specific deploy scripts), exclude build servers, and scope to internet-facing web tiers and UAT/staging hosts. Sysmon for Linux events may use a different sourcetype in your deployment; adjust index/sourcetype accordingly. Pair with file-integrity monitoring on upload and deployment directories.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Backdoored / Unofficial ARTEX Docker Image or Repository Used (CRAFTY FALCON Tooling) (locked: unlock with TL Creds)
- CRAFTY FALCON - New AWS IAM Principal, Access Key or Policy Attachment by Non-Automation Identity (locked: unlock with TL Creds)
- Scripted LLM API Egress from Servers (AI-Assisted Offensive Framework Backend) (locked: unlock with TL Creds)
- CRAFTY FALCON - Offensive AI Framework Execution (ARTEX, PentAGI, Cairn, CyberStrikeAI) (locked: unlock with TL Creds)
- CRAFTY FALCON - Log Deletion and Security Tool Tampering (Anti-Forensics) (locked: unlock with TL Creds)
- CRAFTY FALCON - Hard-Coded Credential and API Token Hunting in Files (locked: unlock with TL Creds)
- CRAFTY FALCON - AWS SSM SendCommand / Lambda UpdateFunctionCode by Non-Pipeline Identity (locked: unlock with TL Creds)
- CRAFTY FALCON - Rs 1 Micro-Transfer Followed by Large Transfer to Same Beneficiary (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CERT-In's CRAFTY FALCON Advisory: AI Is the Accelerant, Your Payment APIs Are the Target (Cyble)](https://cyble.com/blog/crafty-falcon-ai-assisted-financial-threat-actor/)
- [CERT-In Advisory CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON](https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2026-0058&pageid=PUBVLNOTES02)
- [The Hacker News: Backdoored Docker Image for ARTEX AI](https://thehackernews.com/2026/11/backdoored-docker-image-for-artex-ai.html)
- [Business Standard: China-linked tools used in AI-driven cyberattacks on Indian financial firms](https://www.business-standard.com/industry/news/china-linked-tools-used-in-ai-driven-cyberattacks-on-indian-financial-firms-126110500996_1.html)
- [CSA Research Note: Crafty Falcon - Weaponized Pentest Agents Hit the Financial Sector](https://labs.cloudsecurityalliance.org/research/csa-research-note-crafty-falcon-autonomous-offensive-ai-fram/)
- [CSA Research Note: Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX](https://labs.cloudsecurityalliance.org/research/csa-research-note-cyberstrikeai-artex-multi-agent-offense-20/)
- [PentAGI (VXControl) GitHub repository](https://github.com/vxcontrol/pentagi)
- [YourStory: CERT-In warns NBFCs and fintech firms of AI-driven attacks](https://yourstory.com/2026/11/cert-in-warns-nbfcs-and-fintech-firms-of-ai-driven-attacks)
- [Moneylife: Crafty Falcon cyber threat escalates as AI-driven attacks target banks, fintechs and NBFCs](https://www.moneylife.in/article/crafty-falcon-cyber-threat-escalates-as-aidriven-attacks-target-banks-fintechs-and-nbfcs/82128.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5759