The Indian Computer Emergency Response Team (CERT-In) has issued a warning about AI-assisted cyber threats targeting the Banking, Financial Services, and Insurance (BFSI) sectors. The threat actor, known as Crafty Falcon, employs sophisticated AI-driven tools such as ARTEX, PentAGI, Cairn, and CyberStrikeAI to compromise organizations.
Impact on Financial Institutions
This ongoing threat poses significant risks to financial institutions, leveraging AI tools that can autonomously execute attack chains at high speed. These tools generate numerous customized attack scripts, quickly adapting their tactics based on the target’s response. The attackers rotate their IP addresses frequently to evade detection.
In addition to financial institutions, cryptocurrency exchanges and digital asset service providers have also been targeted, leading to the theft of keys and funds. The attackers exploit vulnerabilities in internet-facing applications and exposed APIs, enabling them to steal credentials and execute unauthorized fund transfers.
Exploitation Techniques and Defense Strategies
CERT-In’s alert highlights several tactics used by attackers, including the use of stolen API tokens, supply chain compromises, and the exploitation of plaintext credentials. These methods bypass traditional application controls, allowing attackers to conduct fraudulent transactions and move funds to mule accounts.
The attackers also target cloud infrastructure, execute commands to deploy malicious payloads, and exploit non-production environments to access shared credentials. CERT-In emphasizes the importance of robust security measures, such as multi-factor authentication and regular security audits, to mitigate these risks.
Response and Mitigation Efforts
In response to these threats, CERT-In has released the Artificial Intelligence Security Auditing Guidelines. These guidelines outline necessary steps to ensure the governance, security, and transparency of AI systems. Companies are encouraged to implement human oversight and emergency interruption capabilities for high-risk AI systems.
The misuse of open-source tools like ARTEX has prompted its developer to remove it from GitHub. However, copies continue to circulate online, some of which contain backdoors granting unauthorized root access. Security experts warn that these backdoors can be used to manipulate targets’ systems and exfiltrate sensitive data.
Looking Ahead
The discovery of backdoored ARTEX consoles highlights the ongoing challenges in cybersecurity, particularly with AI-driven threats. As these technologies evolve, organizations must remain vigilant and proactively update their security protocols. Continuous monitoring and third-party assurance are crucial to safeguarding against future attacks.
