India flags Chinese-linked AI tools in hacking campaign against financial firms
India’s cybersecurity agency said the attackers used publicly available AI tools to automate break-ins “at machine speed”, calling the threat “active and ongoing”.
A man types on a computer keyboard in front of the displayed cyber code in this illustration picture taken on Mar 1, 2017. (Photo: Reuters/Kacper Pempel)
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
BENGALURU/MUMBAI: India’s cybersecurity agency named the hacking group behind a wave of AI-driven attacks on financial firms and identified its tools, at least two of them linked to China, adding India to a growing list of countries where such tools have been used against banks.
The group, which the Indian Computer Emergency Response Team (CERT-In) calls “Crafty Falcon,” has breached non-bank lenders, fintech firms and cryptocurrency exchanges, according to an advisory issued on Wednesday (Nov 4).
CERT-In did not say who was behind the breaches or where the organisation operates.
The advisory came after a spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, even as authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks.
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
CERT-In said the attackers use publicly available AI tools to automate break-ins “at machine speed”, calling the threat “active and ongoing”.
It named four tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of them to China.
China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said.
It said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.
CERT-In did not name the affected companies or say how much money was stolen.
The agency did not say the attacks were state-sponsored and the tools it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked to the South Korean attacks.
CERT-In, the Indian Cybercrime Coordination Centre and India’s IT ministry did not immediately respond to requests for comment.
PAYMENT INTERFACES TARGETED
CERT-In said Crafty Falcon “surveys its targets with machine intelligence” and moves money by invoking victims’ own payment and disbursement systems.
Attacks were timed around holidays, weekends and other low-monitoring periods to delay detection. Firms that had fixed flaws after earlier alerts were attacked again after incomplete remediations were made, it said.
Reuters previously reported, citing a police complaint, that last month two Mumbai-based non-bank lenders lost about US$2 million in more than 700 unauthorised instant transfers from accounts of India’s third-largest lender ICICI Bank on Oct 8 and 9.
The complaint said hackers compromised its application programming interfaces (APIs), the software links banks use to connect with non-bank lenders and fintech firms to send loan-disbursal instructions.
State Bank of India, the country’s largest lender, disclosed a dark-web leak of 3,897 customer records last month. Spandana Sphoorty Financial, a non-bank lender, reported unauthorised debits from a bank account on Nov 1, and AU Small Finance Bank said it was probing a potential customer-data leak.
CERT-In did not say which incidents were linked to Crafty Falcon.
Source: Reuters/aj
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
