Short answer: CERT-In warned of AI-driven attacks using ARTEX, targeting financial and crypto businesses. Follow CERT-In guidelines to secure your systems.
TL;DR
- AI tools like ARTEX are being used in attacks.
- Financial and crypto companies are at risk.
- Initial access is gained through non-production environments.
- Crafty Falcon uses AI to automate attacks.
What happened?
CERT-In has flagged AI-driven attacks, particularly using the ARTEX tool, targeting financial and cryptocurrency businesses. These attacks exploit vulnerabilities in non-production environments, using AI to automate and refine attack scripts. The threat actor, known as Crafty Falcon, gains initial access and uses AI to move funds and bypass security controls. Organizations must follow CERT-In’s guidelines to secure their systems against such threats.
- Vulnerability
- A mistake or weakness in software that an attacker can misuse.
- Malware
- Harmful software made to spy, steal or damage.
- Credentials / secrets
- Passwords, keys and tokens that prove who you are to a system.
Key facts
| Reported by | The Hacker News |
|---|---|
| Date reported | 05 Nov 2026 |
How it works
Crafty Falcon uses AI tools like ARTEX, which are like smart robots that can find and exploit security holes. They target non-production environments, steal credentials, and make small test transactions to validate big money moves. They also delete logs and use cloud services to blend in.
- Exploit non-production environments
- Steal shared credentials
- Reverse-engineer application code
- Initiate unauthorized API calls
- Perform micro-value tests
Timeline
| Date | Event | Source |
|---|---|---|
| 2026-11-05 | Reported by The Hacker News | The Hacker News |
| 2026-11-12 | This Skillmate explainer published | Skillmate |
How to fix it
- Keep the operating system, browser and security software updated.
- Do not open unexpected attachments or install software from unofficial sources.
- Report suspicious files or pop-ups to your IT or security team.
How to detect it
Defenders should look for unusual logins, unexpected crashes, and suspicious network activity.
Signs to watch for:
- Unknown programs starting at boot, or new scheduled tasks.
- Security software that was turned off without a reason.
- Unusual outbound connections from a workstation.
What is confirmed
- Reported by The Hacker News
- Reported by Infosecurity Magazine
- Reported by www.cert-in.org.in
Why it matters
This matters because it highlights the growing threat of AI-driven attacks, which can bypass traditional security measures. Companies and users need to be vigilant and update their security practices to protect against these sophisticated threats.
Learn the skills behind this story
Want to understand attacks like this and defend against them? Join Skillmate cybersecurity training or practise hands-on in Skillmate Labs.
FAQ
What are the signs of an AI-driven attack?
Signs include unusual logins, unexpected crashes, and suspicious network activity. Legitimate users accessing systems from new IP addresses during low-monitoring periods might be a false positive.
How can companies protect against AI-assisted attacks?
Companies can protect by implementing multi-factor authentication, regularly updating systems, and using AI security auditing guidelines provided by CERT-In.
What tools are being used by the threat actors?
The threat actors are using ARTEX, CyberStrikeAI, and Cairn, which are AI-driven penetration testing tools.
How can organizations respond to these attacks?
Organizations should report incidents to CERT-In and ensure complete remediation of vulnerabilities, especially during high-risk periods like holidays and weekends.
Related Skillmate posts
Sources
- CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access (The Hacker News)
- India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses (Infosecurity Magazine)
- CERT-In (primary source) (www.cert-in.org.in)
- CERT-In (primary source) (www.cert-in.org.in)
How we wrote this: facts come from the sources above. An on-prem AI model drafted the plain-English parts and every sentence was checked against the sources; unsupported sentences were removed. MITRE mapping is our own judgement.
Watch today's video brief: https://youtu.be/yaK-CF987xg