Threat video1:00
CRAFTY FALCON Payment API Abuse: Detection & IOCs
CRAFTY FALCON abuses victims' payment APIs with Rs 1 test transfers before mule cash-outs. 9 detection rules, 16 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for CRAFTY FALCON Payment API Abuse: Detection & IOCs →
Chapters
- 0:00The hookAn AI-assisted actor attacks Indian finance firms.
- 0:04The storyCERT-In named CRAFTY FALCON.
- 0:11Attack pathThey exploit exposed test apps.
- 0:26AttributionAttributed to CRAFTY FALCON.
- 0:31Indicators of compromise10 indicators to hunt: 3 URLs and 7 package names.
- 0:37MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to impact.
- 0:42Remediation5 steps now: Isolate suspicious hosts, preserve evidence and logs, rotate all credentials.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00An AI-assisted actor attacks Indian finance firms.
0:05CERT-In named CRAFTY FALCON.
0:07Re-targets victims after incomplete fixes.
0:11They exploit exposed test apps.
0:14They harvest secrets, then log in.
0:16They pivot to production, then run commands.
0:19Test transfers, then cash-out to mule accounts.
0:26Attributed to CRAFTY FALCON. Confidence: low.
0:3110 indicators to hunt: 3 URLs and 7 package names.
0:3713 ATT&CK techniques, from resource development to impact.
0:425 steps now: Isolate suspicious hosts, preserve evidence and logs, rotate all credentials.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.