CERT-In Warns of CRAFTY FALCON Campaign Targeting Indian Financial Firms

Nov 11, 2026 · Original article ↗

Summary

CERT-In says CRAFTY FALCON is actively targeting Indian financial firms, exploiting exposed staging systems and weak API controls to move funds. Its advisory describes repeat targeting and recommends isolating environments, rotating secrets and monitoring cloud activity

Key points

CERT-In describes CRAFTY FALCON as an active campaign targeting Indian NBFCs, digital lenders, fintechs, payment providers and crypto exchanges; it did not disclose victim numbers or attribute the actor.
The advisory says some organizations previously targeted and remediated were hit again, including after incomplete cleanup, with attacks timed for weekends and holidays.
Reported entry methods include exposed UAT or staging servers, file-upload and deserialization flaws, hardcoded API tokens, plaintext credentials and services without MFA.
The described attack chain uses credentials or network paths shared with production, legitimate AWS Systems Manager and Lambda channels, and payment APIs reached through modified apps and allow-listed fetcher IPs.
CERT-In says attackers test payment routes with small transfers before making larger transfers to mule accounts; the advisory also describes tampered logs and endpoint tools.
Recommended measures include separating non-production from production, using signed server-validated requests and short-lived tokens, flagging small transfers followed by large ones, and monitoring cloud control-plane activity.
Separately, researcher Badbyte reportedly said a GitHub copy of ARTEX fetched a Docker image with a hidden root shell; 62 internet-facing consoles served it between Nov. 2 and 4. The article says this was not linked to CRAFTY FALCON.

Article Details

Attack Vectors: Exposed UAT and staging servers, including file-upload and deserialization flaws, were exploited; the article says exploitation followed public disclosure.
Hardcoded API tokens, plaintext credentials, forged repository commits, and services without MFA provided additional paths into non-production environments.
Credentials and network paths shared between staging and production enabled access to production systems.
AWS Systems Manager and Lambda were used to run commands through legitimate cloud channels.
The attacker reverse-engineered applications, used modified packages to call payment APIs, and routed traffic through allow-listed third-party fetcher IPs.
A Rs 1 transfer tested the payment route before larger transfers to mule accounts; merchant settlement APIs and cryptocurrency wallet keys were also targeted.
Logs and endpoint tools were tampered with. CERT-In said attacks were timed for holidays and weekends and that some previously remediated entities were targeted again.
Defensive Notes: Isolate non-production environments from production; remove shared credentials, keys, databases, and network routes, and alert on UAT-to-production access.
Validate requests server-side, sign them with a nonce and timestamp, use app attestation, and replace fetcher IP allow-lists with mutual TLS or scoped keys.
Scan repositories and CI/CD for secrets; replace long-lived secrets with short-lived scoped tokens and rotate build and deployment tokens.
Flag low-value transfers to new beneficiaries followed by large transfers, and add cooling periods and maker-checker approval for merchant settlements.
Monitor AWS CloudTrail for Systems Manager sessions and SendCommand, production Lambda UpdateFunctionCode, and new IAM users, roles, or keys; default-deny server egress.
Lower alert thresholds during holidays and weekends, and verify eradication forensically.