Weekend Warriors: Chinese-Linked Hackers Are Timing Fintech Attacks for When Nobody's Watching
India's cybersecurity agency CERT-IN has issued a threat update warning that a persistent attacker is methodically targeting the country's financial sector, and doing so with enough patience and tactical awareness to wait until your security team has gone home for the weekend.
The group, which CERT-IN has named CRAFTY FALCON, was first flagged in October. The original advisory put digital lenders, payment processors, fintech platforms, and wallet operators on notice that attackers were probing internet-facing applications, exposed APIs, and privileged endpoints. The goal: get in, abuse payment APIs, and walk off with money.
Several months later, the attacks are still working. What makes the updated advisory particularly uncomfortable reading is that some of the victims getting hit again are organisations that already tried to fix things after the first incident. Incomplete remediation, it turns out, is almost as bad as none at all. CRAFTY FALCON noticed the gaps and came back.
The timing is deliberate. CERT-IN explicitly notes that attacks have been scheduled to coincide with public holidays, weekends, and other low-staffing windows. Less monitoring means more time before anyone notices something is wrong, and more time means more damage.
On the tooling side, the group uses a cluster of AI-assisted utilities including ARTEX (a penetration testing tool), the Cairn attack search engine, and something called CyberStrikeAI. CERT-IN has linked these tools to users who appear to be Chinese-speaking, though attribution in this space always deserves a pinch of salt.
The operational playbook is reasonably sophisticated. CRAFTY FALCON starts by hunting for development and test environments accidentally left exposed to the internet. These are goldmines of careless credential storage, stray tokens, and network paths that point straight into production systems. Once inside production, the crew modifies applications to make unauthorised API calls. Because the calls originate from what looks like a legitimate app, standard defences tend not to flag them.
When victims do start investigating, CRAFTY FALCON has already generated a large volume of near-identical malware variants in quick succession, which CERT-IN describes as consistent with AI-assisted development. Sorting through that noise takes time the defenders don't have.
The financial exfiltration follows a recognisable pattern. First, a test transaction of roughly one US cent to confirm the payment channel works. Then larger transfers once the plumbing checks out. For targets handling cryptocurrency, the crew goes straight for wallet keys and drains balances entirely.
CERT-IN's recommendations are broadly sensible if unremarkable: better logging, real-time anomaly detection, pulling test environments off public-facing infrastructure, and tightening access to cloud resources that CRAFTY FALCON has been using as attack infrastructure. The agency is also calling for round-the-clock monitoring, which will delight anyone selling observability platforms into the Indian market.
The advisory covers the broader banking, financial services, and insurance sector, though the specific organisations confirming attacks so far are concentrated among the fintech-native businesses rather than traditional banks. Whether that reflects where the attacks are actually landing, or simply where incident reporting is more forthcoming, is an open question.