CERT-In names AI-assisted 'CRAFTY FALCON' group attacking financial firms' payment APIs
The Indian Computer Emergency Response Team (CERT-In) named an AI-assisted threat actor, CRAFTY FALCON, on 4 November 2026. Its Critical advisory says the group hits NBFCs, fintech firms and crypto exchanges. It calls their own payment and disbursement APIs to move money. CERT-In named four public AI attack tools and called the threat active and ongoing.
Syllabus: GS2 · Statutory & Regulatory Bodies; GS3 · IT, Space, Biotech & IPR; GS3 · Cyber Security & Money Laundering
Why this matters for UPSC
GS3 security: basics of cyber security and CERT-In under the IT Act, 2000. Prelims can ask CERT-In's functions and 2022 directions; Mains, AI-driven threats to financial firms.
Why it matters
A digital lender or a crypto exchange can lose money without any customer being hacked, because the attacker orders the firm's own systems to pay out. The tools work at machine speed and pick holidays, so a small firm with a thin security team may notice only after the funds have gone. Each successful raid also dents trust in digital lending, which depends on banks, NBFCs and fintech apps talking to each other through software links. The case shows offensive AI cutting the skill needed to mount a serious attack. That pushes regulators and firms toward constant watch and repeated checks instead of a one-time fix after each alert.
Prelims pointers
- The Central Government appoints CERT-In by notification in the Official Gazette under the Information Technology Act, 2000.
- CERT-In's statutory functions include collecting and spreading information on cyber incidents, forecasts and alerts, emergency measures and coordinating incident response.
- Advisories are guidance; the IT Act, 2000 also lets CERT-In call for information and give directions to service providers, intermediaries, data centres and body corporates.
- CSIRT-Fin is the finance-sector incident response team working under CERT-In, which belongs to the Ministry of Electronics and Information Technology.
- CERT-In's 2022 directions require ICT system logs to be kept for a rolling 180 days within India and shared with CERT-In on demand.
- The 2022 directions make virtual asset exchanges and custodian wallet providers keep KYC information and transaction records for five years.
- Attacks on digital payment systems, cloud systems, virtual asset exchanges and AI systems are among incidents that must be reported to CERT-In.
Practise a UPSC-style question
With reference to the Indian Computer Emergency Response Team (CERT-In), consider the following statements:
1. It is appointed by the Central Government under the Information Technology Act, 2000 as the national agency for cyber incident response.
2. It functions under the Ministry of Home Affairs.
3. Issuing advisories and vulnerability notes on information security is one of its statutory functions.
Which of the statements given above is/are correct?
- (a) 1 and 2 only
- (b) 2 and 3 only
- (c) 1 and 3 only
- (d) 1, 2 and 3
Show the answer
Answer: (c) 1 and 3 only
Answer: (c) 1 and 3 only. CERT-In is a statutory agency under MeitY with advisory functions.
Statement 1: correct. The Information Technology Act, 2000 lets the Central Government appoint CERT-In, by Gazette notification, as the national incident response agency.
Statement 2: incorrect. CERT-In works under the Ministry of Electronics and Information Technology (MeitY), not the Ministry of Home Affairs.
Statement 3: correct. The Act lists issuing guidelines, advisories, vulnerability notes and white papers among CERT-In's functions.
Eliminate: statement 2 is wrong, so every option that includes 2 goes. Out: (a), (b), (d).
Trap: Swapped attribution. Cyber crime and cyber security sound alike, so the question pins CERT-In on the Home Ministry, which runs the cybercrime coordination centre instead.
Remember: CERT-In: IT Act, 2000; national incident response agency; under MeitY.
More from the 7 November 2026 edition
- Centre orders weekly rice stock disclosure, doubles OMSS rice sale target Economy
- MeitY approves 12 more ECMS projects; approved investment reaches Rs 77,051 crore Economy
- NHAI standardises toll plaza design for barrier-less MLFF tolling Economy
- Supreme Court settles Himachal's Bhakra-Beas power dues with Punjab, Haryana Polity
- Supreme Court: OBC creamy layer income ruling will not apply retrospectively Polity
- UNESCO's Memory of the World Asia-Pacific Register adds Mahabharata, Arthashastra, Rajatarangini National
- CAQM serves show-cause notices on Punjab DCs and SSPs over stubble burning Environment
- Kerala notifies Calicut University garden as Biodiversity Heritage Site Environment
- Home Ministry exemption order now requires visas for six persecuted minorities Polity