In India, cybercriminals have committed major financial scams targeting financial companies. According to an ET report, in the last two months, non-banking finance companies (NBFCs) in the country have allegedly received around Rs. 300 crores has been withdrawn. About 150 complaints or FIRs have been registered in this matter. These attacks specifically targeted small NBFC companies, which had relatively weak cyber security systems. According to sources connected to the investigation, the role of Chinese hacking platforms and artificial intelligence (AI) toolkits has come to light in some cases. The incident has once again raised the question that while finance companies are becoming increasingly digital, are their cyber security systems strengthening at the same pace?
What is the whole case and how did the loss of 300 crores happen?
According to the report, there have been cyber attacks on many small non-banking financial companies in the country in the last two months. These attacks brought to light incidents of taking advantage of technical vulnerabilities of companies to withdraw huge sums of money.
It has been reported that NBFCs have been attacked twice in Delhi. The first attack caused a loss of around Rs 7.5 crore to the company, while a few days later the second attack caused a loss of around Rs 7.25 crore. That is, it has been revealed that the same company has suffered a loss of around 14.75 crore rupees in two separate attacks.
According to sources involved in the investigation, these attacks had the biggest impact on companies whose businesses were relatively small and whose cyber security systems were not strong enough. The report said that many cases are still under investigation. Therefore, the methods used and the identity of those responsible for all incidents cannot be considered conclusively established.
An arm of a Chinese hacking platform
Cyber security agencies are working round the clock to tackle this situation and are advising NBFCs (non-banking financial companies) to upgrade their infrastructure as soon as possible. In the case where investigations have been completed, agencies have found that a Chinese hacking platform called ‘Cyberstrike’ is behind it. Other cases are still under investigation. Two Chinese artificial intelligence (AI) toolkits – ‘Artex’ and ‘CyberStrike’ – as well as Chinese open-source models like ‘DeepSeek’, Alibaba’s ‘Qwen’, Moonshot’s ‘Kimi’ and Zipu’s ‘GLM’, experts said in an ET report, have helped the financial system in India and across the world. take aim. Companies in Japan and South Korea are also facing these attacks.
This is how the attacks are happening
An official with knowledge of the probe told an ET report that some small NBFCs do not know what kind of infrastructure they should have or when to conduct audits. Besides, their systems are also very weak. As of October 15, a total of 8,502 NBFCs were registered with the banking regulator. According to sources, around 30 complaints have been registered in Mumbai, over 25 in Delhi and 15-16 in Chennai and other cities. Complaints or FIRs related to cyber fraud are often kept confidential as they are sensitive matters.
Another official said that the fraudsters analyze the performance of the NBFC for the first 10-12 days. They see how payments are made, who the organization’s ‘whitelisted’ IDs are and what vulnerabilities are in their system’s code – that’s when they attack. However, these hacking methods are not very advanced technically. But with the help of AI models and toolkits, it has become easier to reach them. All you have to do is drop the toolkit into the AI model and give a ‘prompt’,” an official monitoring the matter told an ET report. After this the tool will do the hacking for you. He said this paves the way for ‘Jamatara-style’ social engineering techniques in those NBFCs that are weak in terms of security.
Cyber attacks also took place in South Korea
Cyber intelligence firm Sybil found that a loan inquiry service was targeted in a recent attack in South Korea. After stealing the data, the attacker asked the AI where it could be sold and which Telegram groups deal with such information. If a caller knows your name, loan institution and loan amount, it looks trustworthy, said Mandar Patil, Executive Vice President of Cybal, in an ET report. LLM (Large Language Model) can make such calls in fluent Hindi or Tamil. Patil further said that Indian companies that were attacked should send advance warnings to their customers, so that they can avoid phishing calls.
SBI has issued an advisory
State Bank of India (SBI) on Friday sent an advisory to customers who were affected by the recent data leak. Due to this leak, a dataset containing 3,75,000 records was exposed on the dark web. India’s nodal cyber security agency ‘CERT-In’ said that due to this framework, the time from breach to damage in the system has now been reduced from days to a few hours, as it has multiple AI agents working together. Organizations that did not fully patch their vulnerabilities were attacked again on a larger scale within days. CERT-In has asked organizations to alert their ‘Red Teams’ and prioritize alerts related to ARTEX and CyberStrike.
