Threat actor targets Indian fintechs on weekends when defenders aren’t watching

India’s Computer Emergency Response Team (CERT-IN) says attacks on financial technology businesses are escalating, with a group it calls CRAFTY FALCON deliberately returning to organisations after earlier incidents. The attacks matter because they exploit weak links between internet-facing test systems and production services, then alter applications to make unauthorised payment API calls that may evade normal checks.

CERT-IN first detected the activity in October and says attacks have continued, including against victims whose fixes were incomplete; some incidents were timed for weekends, holidays and other periods of low monitoring. The group uses AI-assisted security tools, tests its access with payments of about $0.01 before attempting larger transfers, and targets cryptocurrency providers for wallet keys. CERT-IN urges round-the-clock monitoring, stronger logging and alerts, keeping test environments off the internet, and limiting access to cloud resources.