CERT-In · Financial services · Payment controls
India’s cyber agency warns that attackers are abusing payment systems
India’s Computer Emergency Response Team issued a critical advisory on November 4 after analyzing reported attacks on financial firms, including fintechs and lenders. CERT-In calls the campaign CRAFTY FALCON and says it continues to receive reports of successful attacks, including repeat targeting after remediation. It identified several publicly available AI-assisted security tools and describes tooling that can carry out attack sequences autonomously. The public account gives limited detail about how attackers divided work between people and software in individual cases.
An October advisory describes attackers using stolen credentials to call a victim’s own payment services and bypass checks in the application. The November update describes small test payments followed by larger transfers. This puts the key control at the point where money moves. An internal request can carry valid credentials while still lacking approval for that particular recipient or amount.
CERT-In recommends checking the transfer within the payment service itself and flagging rapid or unusually large transfers to new beneficiaries. For a financial firm considering more automation, the question is where it can enforce those limits even if an application or account is compromised. The payment system needs to verify who approved a transfer and what they approved.
CERT-In’s November 4 campaign advisory ↗CERT-In’s October advisory on payment service abuse ↗
CrowdStrike · SafeMind · Security testing
The security guard hires a practice burglar
CrowdStrike unveiled Agentic Adversary Emulation on November 4, a day after announcing the Fiddler AI and Dreadnode acquisition agreements. The new offering uses its SafeMind security models to test how weaknesses might combine into a route to a sensitive system. CrowdStrike says it can prioritize fixes and repeat a test to check whether a route is still open. The company lists early access for select customers through Project QuiltWorks partners.
A practical test might ask whether access to an ordinary service can lead to a system that holds sensitive data. Rerunning the same test after a fix gives the team a way to check whether it broke that particular chain. Wider coverage would require evidence across different environments and attack paths.
The tester needs clearly defined authority over the systems it exercises, especially if a test can disrupt a service. Checking that a route exists and applying a change to a live system are separate decisions. A practice burglar should know which locks it has permission to try.
CrowdStrike’s announcement and early access details ↗
Baidu · Apollo World · Robotaxi simulation
Baidu gives robotaxis more road to practise on
Baidu introduced Apollo World on November 3. According to Reuters, the company says the system can generate up to 100,000 kilometres of simulated driving per day and supply synthetic camera and lidar observations. Baidu says it already uses the system to train its Apollo Go fleet. The mileage figure is the company’s estimate of simulator output.
A simulated intersection lets a developer repeat an encounter and vary one detail at a time, such as the timing of a turn or a pedestrian stepping out from behind a van. That makes rare situations easier to practise. How much the exercise helps depends on how faithfully the simulator models the things a vehicle has to sense and respond to.
A useful comparison would track whether vehicles trained on those scenarios perform better in comparable road tests. It would also show where the simulation misses details such as reflections, weather or unexpected human decisions. A robotaxi can repeat the virtual intersection all day. The real intersection still gets a vote.
Reuters reporting on Baidu’s announcement and mileage claim ↗