# Threat actor targets Indian fintechs on weekends when defenders aren’t watching

- URL: https://talkfuse.com/story/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/
- Published: 2026-11-06T01:17:40+00:00
- Updated: 2026-11-06T02:03:30+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/5308000
- Topics: AI, Asia, Technology, World

## Key points

- CERT-IN warns that attacks on Indian financial firms are escalating.
- CRAFTY FALCON returns to victims after incomplete fixes.
- The group times attacks for weekends and holidays.

## Summary

India’s Computer Emergency Response Team (CERT-IN) says attacks on financial technology businesses are escalating, with a group it calls CRAFTY FALCON deliberately returning to organisations after earlier incidents. The attacks matter because they exploit weak links between internet-facing test systems and production services, then alter applications to make unauthorised payment API calls that may evade normal checks.

CERT-IN first detected the activity in October and says attacks have continued, including against victims whose fixes were incomplete; some incidents were timed for weekends, holidays and other periods of low monitoring. The group uses AI-assisted security tools, tests its access with payments of about $0.01 before attempting larger transfers, and targets cryptocurrency providers for wallet keys. CERT-IN urges round-the-clock monitoring, stronger logging and alerts, keeping test environments off the internet, and limiting access to cloud resources.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.