India’s cybersecurity agency has named the hacking group behind a wave of AI-driven attacks on financial firms and identified the tools it used, at least two of them linked to China, adding India to a growing list of countries where such software has been used against banks.
The group, which the Indian Computer Emergency Response Team (CERT-In) calls “Crafty Falcon,” has breached non-bank lenders, fintech firms and cryptocurrency exchanges, according to an advisory issued on Wednesday (November 4, 2026).
The agency did not say the attacks were state-sponsored and the tools it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked to the South Korean attacks. It said a China-linked group also used the tool in an espionage campaign targeting more than 200 organisations in at least 14 countries.
CERT-In said the attackers use publicly available AI tools to automate break-ins “at machine speed”, calling the threat “active and ongoing”. China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said.
