The Indian Cybercrime Coordination Center, known as I4C, and the Indian Computer Emergency Response Team, or CERT-In, have issued a critical warning to the Indian financial sector. These government agencies have identified a significant threat involving artificial intelligence based cyberattacks targeting banking institutions, Non-Banking Financial Companies or NBFCs, and fintech companies. The primary objective of these sophisticated intrusions is to facilitate the unauthorized withdrawal of funds amounting to crores of rupees. According to the agencies responsible for controlling cybercrime in the country, criminals are now deploying AI agents to conduct attacks at machine speed, which poses a severe challenge to traditional security frameworks.
The Emergence of Agentic AI Framework in Cybercrime
The Indian Cybercrime Coordination Center and the Indian Computer Emergency Response Team have highlighted the emergence of the Agentic AI Framework as a primary tool for modern cybercriminals. This framework allows for the execution of attacks at what is described as machine speed: a level of velocity that far exceeds manual intervention or traditional defensive capabilities. By utilizing these automated agents, attackers can target banks, fintech organizations, and Non-Banking Financial Companies with a high degree of precision and efficiency. The agencies have observed that these AI driven frameworks are specifically designed to identify and exploit vulnerabilities within the digital architecture of financial institutions. This shift toward automated, agent based attacks represents a significant evolution in the methods used by cybercriminals to conduct large scale financial theft. The use of such advanced technology ensures that the attacks are not only rapid but also capable of bypassing standard security protocols that were designed for slower, human led intrusions.
The scale of these attacks is significant, with the primary objective being the unauthorized withdrawal of funds amounting to crores of rupees. The agencies have noted that the use of AI allows these criminals to target multiple institutions simultaneously, increasing the potential for large scale financial loss. This new frontier in cybercrime is specifically tailored to bypass the standard security protocols that many financial institutions currently have in place. The transition from manual hacking to AI driven, automated intrusions marks a major shift in the threat landscape, requiring a corresponding evolution in the defensive strategies employed by the financial sector. By operating at machine speed, these AI agents can perform thousands of attempts to breach a system in the time it would take a human to perform one, making the detection and prevention of such activities a critical priority for national security.
Vulnerabilities in IT Infrastructure and Software Systems
A major focus of the investigation by I4C and CERT-In has been the identification of the specific vulnerabilities that allow these AI based attacks to succeed. One of the most prominent issues is the use of outdated and un-updated software within financial institutions. When software systems are not regularly patched and updated, they remain susceptible to known exploits that AI agents can quickly identify and use to gain access. Furthermore, servers that are connected to the internet but lack robust security configurations are being actively targeted by these sophisticated actors. These weak IT systems provide an easy entry point for attackers to gain a foothold within the institution’s digital environment, allowing them to move deeper into the internal network.
In addition to software and server vulnerabilities, the security agencies have highlighted a specific risk associated with online interfaces used for receiving customer complaints. These portals are often designed for ease of use by the public, but if they are not properly secured, they can be exploited by hackers to gain access to the internal networks of banks and fintech firms. Once the attackers have breached these interfaces, they can move laterally through the network to reach more sensitive systems. This finding underscores the importance of securing every digital touchpoint, including those that may seem secondary to core financial processing. The agencies have noted that even a minor weakness in a customer facing portal can lead to a major breach involving the theft of crores of rupees.
Mechanics of Fund Disbursement and Payment APIs
After gaining access to the internal network, the cybercriminals focus their efforts on the automated fund disbursement systems. A key target in these attacks is the Application Programming Interface, or API, which is used to facilitate payment transfers and fund disbursements. By compromising these APIs, the attackers can manipulate the system to authorize the transfer of crores of rupees without the need for manual approval. This stage of the attack is often automated, allowing the criminals to move large sums of money with incredible speed. The targeting of these specific systems shows a high level of technical knowledge and a strategic focus on the most critical components of the financial institution’s payment infrastructure.
The manipulation of payment APIs is particularly dangerous because these interfaces are designed to be fast and efficient, often bypassing the slower security checks used for manual transactions. Once the AI agents have identified the correct API endpoints, they can initiate a series of rapid transfers that drain the institution’s funds in a matter of seconds. This automated approach to theft is what allows the criminals to withdraw crores of rupees before the breach is even detected by the bank’s monitoring systems. The agencies have emphasized that the security of these APIs is now a critical factor in protecting the overall integrity of the financial system against AI driven threats.
Movement of Stolen Funds and Evidence Destruction
To manage the stolen funds, the criminals utilize a network of mule accounts: these are bank accounts specifically set up or co-opted to facilitate illegal transactions and hide the trail of stolen money. Once the unauthorized withdrawals are initiated, the money is transferred into these mule accounts to create a layer of separation between the theft and the criminals. From there, the funds are rapidly moved through standard electronic payment systems like IMPS and NEFT to other accounts or withdrawn as cash. This process is designed to be as fast as possible, often completing before the bank’s security systems can flag the activity as suspicious. The use of mule accounts is a standard tactic in financial crime, but the speed at which it is now being executed thanks to AI automation presents a new challenge for law enforcement.
Following the successful theft and movement of funds, the cybercriminals take active steps to cover their tracks and evade subsequent investigations. This involves attempting to delete digital records and erase any evidence of their intrusion into the bank’s systems. By destroying these digital footprints, the attackers aim to prevent law enforcement agencies from identifying the source of the attack or the destination of the stolen crores. This focus on evidence destruction is a key part of the criminal operation, intended to ensure that the perpetrators can continue their activities without being caught. The agencies have noted that the ability to wipe digital evidence at machine speed makes the task of forensic investigators much more difficult, requiring more advanced tools to recover the lost data.
Implementation of Critical Security Advisories
In response to these emerging threats, CERT-In has released two Critical Cyber Security Advisories that must be implemented with high priority by all relevant entities. These guidelines apply to a broad range of organizations, including all banks, Non-Banking Financial Companies, fintech companies, payment aggregators, and payment gateways operating within the country. The agencies have emphasized that the implementation of these guidelines must be treated as a high priority to safeguard the national financial infrastructure. Key recommendations include the immediate updating of all software and the securing of all internet facing servers to prevent unauthorized access. Institutions are also strongly encouraged to conduct thorough security audits of their payment APIs and automated fund transfer systems to ensure they are protected against AI driven intrusions.
Beyond the cybercrime warnings, the source material also includes an unrelated factual update regarding public services in Mumbai. It states that the sale of platform tickets has been suspended at five of the most major railway stations in the city. This administrative measure is scheduled to remain in effect until November 15 as part of local management efforts. While this is a separate development from the warnings issued by I4C and CERT-In, it is a significant factual detail provided in the report. This context of heightened security and administrative caution underscores the current environment in which both financial and public institutions are operating to ensure the safety and security of the public and their assets.
Source / स्रोत: India TV
