|
The National Cybercrime Threat Analysis Unit (NCTAU) of Indian Cyber Crime Coordination Centre (I4C) and CERT-In, Ministry of Electronics and IT has noticed a trend in cyber-attacks based cyber frauds on Banks, Non-Banking Financial Companies (NBFCs) and FinTech Companies.
"These attacks are financially motivated and are being carried out with the helpof Artificial Intelligence (AI) agents leading to machine speed compromise. Multi-crore unauthorizedtransaction through fund disbursement systems and APIs are being found in individual cases," read the advisory from 14C. The advisory said that Perpetrators exploit unpatched software or mis-configured internet exposed Servers / ITsystems to compromise the infrastructure. This also includes customer end complaint interface, according to the advisory, adding that Hackers then target automated fund disbursement systems or special interfaces (APIs) usedfor payments and fund transfers. "Use of Agentic AI Framework makes the attack possible atmachine speed," it said. The money is subsequently transferred to 'mule' accounts, which are bank accounts used by criminals to receive and move illegally obtained funds. These accounts may be spread across multiple banks, allowing the money to be quickly transferred or withdrawn through Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT). "Then perpetrator delete records and hide their tracks so that investigation becomes difficult," the advisory added. The advisory has directed financial institutions to take security measures, including: Keep a complete list of all digital interfaces (APIs) used for payments and remove or switch offold, unused or test interfaces. Banks Chief Information Security Officers Team and Transaction Monitoring Team and IT Teammay work in close coordination for proactively mitigating the API attack risks. Set daily and per-transaction limits, verify beneficiary names and accounts, and watch for unusualspeed of transactions. Banks Check for NBFCs Access token failures from non-whitelisted IPs. Strengthen the customer facing & complaint receiving infrastructure for any potential attempts ofintrusion. Thorough secure architecture review may be conducted to prevent lateral movement. Sudden change in transaction narration patterns and beneficiary profiles or volume may bemonitored by transaction monitoring team. Make sure money cannot be sent out unless all earlier checks (KYC, approval, etc.) have beencompleted properly. Run authorised red-team exercises that simulate machine-speed attacks, and measure howquickly SOC and payment controls respond. (ANI)
|
