The Indian Computer Emergency Response Team (CERT-In) has revealed that a threat actor known as Crafty Falcon, which they track using AI, is actively targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sector in the country. Other significant post-exploitation actions include: Reverse-engineering application codebases to create tailored exploits Triggering unauthorized API calls through modified application packages, bypassing controls that "assumed only the legitimate client application would call the APIs" Executing micro-value test transactions (e.g., Rs.
1) to validate unauthorized fund flows before executing large-value transfers Leveraging merchant settlement APIs of payment aggregators to move funds Exploiting newly disclosed vulnerabilities, including file-upload and deserialization exploit chains leading to web shells in PHP and Node.js applications Generating a large number of custom scripts on the fly and rapidly improving them, a pattern consistent with AI-assisted development This development comes as CERT-In has published the Artificial Intelligence Security Auditing Guidelines, outlining specific requirements to ensure the "governance, security, privacy, fairness, transparency, resilience, and auditability of AI systems." The framework mandates testing of an AI agent's documented identities, authorized objectives, approved tool use, permission boundaries, and adherence to the principle of least privilege (PoLP).
"Effective assurance necessitates organizational accountability, technical testing, data and model governance, continuous monitoring, human oversight, incident response, and third-party assurance," the agency declared.
