The Register - Security • 5m
Threat Actor Targets Indian Fintechs on Weekends When Defenders Aren't Watching
CERT-IN has issued a critical alert regarding AI-powered cyberattacks targeting Indian banking and fintech firms, concentrated during weekends to exploit reduced SOC staffing. Threat actors utilize LLM-generated phishing, deepfake social engineering, polymorphic malware loaders, and rotating C2 infrastructure to evade signature-based EDR and maintain persistence. Intrusions involve off-hours RDP/SSH access, low-and-slow beaconing, and automated exploitation of fintech APIs and payment gateways. Victims remain compromised despite remediation attempts, indicating adaptive TTPs. Primary risks include financial loss, operational downtime, reputational damage, and regulatory escalation.