{"id":"https://openalex.org/W7225396180","doi":"https://doi.org/10.5281/zenodo.23995263","title":"The Escalation of AI-Powered Cyberattacks in the Global Financial Sector: Analyzing the \"Crafty Falcon\" Threat, API Vulnerabilities, and Automated Defense Strategies","display_name":"The Escalation of AI-Powered Cyberattacks in the Global Financial Sector: Analyzing the \"Crafty Falcon\" Threat, API Vulnerabilities, and Automated Defense Strategies","publication_year":2026,"publication_date":"2026-11-06","ids":{"openalex":"https://openalex.org/W7225396180","doi":"https://doi.org/10.5281/zenodo.23995263"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.23995263","doi":"https://doi.org/10.5281/zenodo.23995263","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23995263","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.23995263","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118843517","display_name":"Sudhakar Geruganti","orcid":"https://orcid.org/0009-0000-0039-7536","observed_orcids":["https://orcid.org/0009-0000-0039-7536"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"geruganti, sudhakar","raw_affiliation_strings":[],"raw_orcid":"https://orcid.org/0009-0007-0601-0671","affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5118843517"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.48730000853538513,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.48730000853538513,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.13330000638961792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.10040000081062317,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/api-vulnerabilities","display_name":"API vulnerabilities","score":0.6140000224113464},{"id":"https://openalex.org/keywords/financial-cybercrime","display_name":"financial cybercrime","score":0.5709999799728394},{"id":"https://openalex.org/keywords/credential-compromise","display_name":"credential compromise","score":0.5019999742507935},{"id":"https://openalex.org/keywords/ai-based-anomaly-detection","display_name":"AI-driven anomaly detection","score":0.5460000038146973}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.861299991607666},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7278000116348267},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.501800000667572},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.4812999963760376},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.47699999809265137},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.42719998955726624},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.40869998931884766},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.4036000072956085},{"id":"https://openalex.org/C165609540","wikidata":"https://www.wikidata.org/wiki/Q1172486","display_name":"Data breach","level":2,"score":0.3695000112056732},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.3571000099182129},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.3361999988555908},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.3269999921321869},{"id":"https://openalex.org/C203043789","wikidata":"https://www.wikidata.org/wiki/Q138461","display_name":"Digital economy","level":2,"score":0.3091000020503998},{"id":"https://openalex.org/C139043278","wikidata":"https://www.wikidata.org/wiki/Q837171","display_name":"Financial services","level":2,"score":0.30640000104904175},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.29440000653266907},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.28519999980926514},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.27889999747276306},{"id":"https://openalex.org/C2778300220","wikidata":"https://www.wikidata.org/wiki/Q114380","display_name":"Financial crisis","level":2,"score":0.2644999921321869},{"id":"https://openalex.org/C528167355","wikidata":"https://www.wikidata.org/wiki/Q258307","display_name":"National security","level":2,"score":0.2517000138759613}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.23995263","doi":"https://doi.org/10.5281/zenodo.23995263","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23995263","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.23995264","doi":"https://doi.org/10.5281/zenodo.23995264","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23995264","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.23995263","doi":"https://doi.org/10.5281/zenodo.23995263","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23995263","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7163022322","https://openalex.org/W7130722697","https://openalex.org/W7160375559","https://openalex.org/W7084753794","https://openalex.org/W4412883167","https://openalex.org/W4410322775","https://openalex.org/W7160717543","https://openalex.org/W7119489593","https://openalex.org/W4411033991","https://openalex.org/W4408420147"],"abstract_inverted_index":{"**Alternative":[0],"Title:**Automated":[1],"Adversaries,":[2],"Unsecured":[3],"APIs:":[4],"A":[5,229,388],"Comprehensive":[6],"Analysis":[7],"of":[8,29,37,141,163,168,176,224,264,297,428,456,466,517,529,566,613,624,638,676,684,693,714],"AI-Driven":[9,758],"Cyber":[10],"Threats,":[11],"Operational":[12],"Tactics,":[13],"and":[14,20,39,42,54,71,81,95,131,154,187,219,246,267,273,299,319,328,341,382,422,440,470,477,484,506,531,557,594,617,621,643,660,667,690,709,729],"Mitigation":[15],"Frameworks":[16],"for":[17,45,104,336,544,571,679],"Modern":[18],"Banking":[19],"FinTech":[21,72],"Institutions":[22],"**Subtitle:**A":[23],"Research":[24],"Study":[25],"on":[26,76,214],"the":[27,35,43,101,166,174,225,233,295,376,392,415,464,564,597,632,733],"Weaponization":[28],"Artificial":[30,148,739],"Intelligence":[31,149],"in":[32,123,158,217,249,294,338,407,419,435,519,589,647],"Financial":[33,68,741],"Cybercrime,":[34],"Exploitation":[36],"Payment":[38],"Disbursement":[40],"Interfaces,":[41],"Imperative":[44,543],"Proactive,":[46],"AI-Integrated":[47,545],"Security":[48],"Postures":[49],"---":[50],"**Detailed":[51],"Description:**":[52],"**Background":[53],"Context**The":[55],"global":[56,633,734],"financial":[57,159,250,380,551,634,651,702,735],"sector":[58],"is":[59,173,232,391,717],"undergoing":[60],"an":[61],"unprecedented":[62],"digital":[63,91],"transformation,":[64],"with":[65,197,451],"banks,":[66],"Non-Banking":[67],"Companies":[69],"(NBFCs),":[70],"firms":[73],"increasingly":[74],"relying":[75],"interconnected":[77],"systems,":[78,689],"cloud":[79,339],"infrastructure,":[80],"Application":[82,301],"Programming":[83,302],"Interfaces":[84,303],"(APIs)":[85],"to":[86,127,151,193,206,243,260,309,323,350,354,370,394,449,490,502,521,534,575,596,631,640,645,697,705],"deliver":[87],"services.":[88,695],"While":[89],"this":[90,169],"evolution":[92,434],"enhances":[93],"efficiency":[94],"customer":[96],"experience,":[97],"it":[98],"simultaneously":[99],"expands":[100],"attack":[102,209,226,599],"surface":[103],"cybercriminals.":[105],"Recent":[106],"advisories":[107],"from":[108,257,656,732],"national":[109],"Computer":[110],"Emergency":[111],"Response":[112],"Teams":[113],"(CERTs)":[114],"have":[115,399],"sounded":[116],"alarm":[117],"bells":[118],"regarding":[119],"a":[120,142,254,261,292,432,526,532,555,628,719,723],"significant":[121,706],"escalation":[122,623],"cyber":[124],"incidents":[125,138],"linked":[126],"unauthorized":[128,316,352],"fund":[129,312,497],"transfers":[130],"data":[132,430],"breaches.":[133],"These":[134,201,582],"are":[135,182,283,333,347,362,438,446,608],"not":[136,411,718],"isolated":[137],"but":[139,410,722],"part":[140],"coordinated,":[143],"sophisticated":[144],"campaign":[145,235],"that":[146,281,404,650,726],"leverages":[147],"(AI)":[150],"automate":[152,641],"attacks":[153,196,437,574,642,716],"rapidly":[155],"exploit":[156,247,535],"vulnerabilities":[157,280,588,700],"systems.":[160,251,356],"**The":[161,542],"Rise":[162],"AI-Powered":[164],"Cybercrime**At":[165],"heart":[167],"new":[170,262],"threat":[171,204],"landscape":[172],"weaponization":[175],"AI":[177],"by":[178,414,602],"malicious":[179,364,579],"actors.":[180],"Cybercriminals":[181],"now":[183],"utilizing":[184],"publicly":[185],"available":[186],"proprietary":[188],"AI-driven":[189,549,568],"offensive":[190],"security":[191,372,458,559,569,606,658],"platforms":[192,570],"conduct":[194],"automated":[195],"minimal":[198],"human":[199],"intervention.":[200],"tools":[202,242,583],"enable":[203],"actors":[205,332,580],"generate":[207],"customized":[208,598],"scripts,":[210],"adapt":[211,595,644],"malware":[212],"based":[213],"system":[215],"responses":[216],"real-time,":[218,590],"carry":[220],"out":[221],"large":[222],"parts":[223],"process":[227],"automatically.":[228],"notable":[230],"example":[231],"ongoing":[234],"dubbed":[236],"\"Crafty":[237],"Falcon,\"":[238],"which":[239],"employs":[240],"AI-powered":[241,625,715],"systematically":[244],"probe":[245],"weaknesses":[248,337,403],"This":[252,460,499],"represents":[253],"fundamental":[255],"shift":[256],"traditional":[258],"cybercrime":[259],"era":[263],"automated,":[265],"intelligent,":[266],"adaptive":[268,558],"adversarial":[269],"operations.":[270],"**Key":[271],"Vulnerabilities":[272],"Attack":[274],"Vectors**The":[275],"research":[276,562],"identifies":[277],"several":[278],"critical":[279,355],"attackers":[282,518,639],"actively":[284,334],"exploiting:":[285],"1.":[286],"**API":[287],"Exploitation:**":[288,360],"There":[289],"has":[290],"been":[291,400],"surge":[293],"misuse":[296],"payment":[298,681],"disbursement":[300],"(APIs).":[304],"Attackers":[305,361,398,486],"leverage":[306],"these":[307,548,699],"interfaces":[308],"facilitate":[310],"fraudulent":[311],"transfers,":[313],"often":[314],"using":[315],"API":[317,744],"calls":[318],"modified":[320],"mobile":[321],"applications":[322],"initiate":[324],"transactions.":[325],"2.":[326],"**Cloud":[327],"Internet-Facing":[329],"Environments:**":[330],"Threat":[331,746],"scanning":[335],"infrastructure":[340],"internet-facing":[342],"testing":[343],"environments.":[344],"Compromised":[345],"credentials":[346],"frequently":[348,447],"used":[349,601],"gain":[351],"access":[353,505],"3.":[357],"**Third-Party":[358],"Service":[359],"routing":[363],"traffic":[365],"through":[366],"trusted":[367],"third-party":[368,694],"services":[369],"bypass":[371],"controls,":[373],"effectively":[374],"leveraging":[375,567],"trust":[377],"relationships":[378],"between":[379],"institutions":[381,552,652],"their":[383,504],"vendors.":[384],"4.":[385],"**Unpatched":[386],"Weaknesses:**":[387],"concerning":[389],"trend":[390,713],"return":[393],"previously":[395,522],"targeted":[396,523],"entities.":[397],"observed":[401],"re-exploiting":[402],"were":[405],"identified":[406],"prior":[408],"warnings":[409],"fully":[412],"remediated":[413],"organization,":[416],"highlighting":[417],"gaps":[418,577],"patch":[420,587,665],"management":[421],"corrective":[423],"action":[424,731],"implementation.":[425],"**Operational":[426],"Tactics":[427],"Cybercriminals**The":[429],"reveals":[431],"strategic":[433],"how":[436],"planned":[439],"executed:":[441],"-":[442,482,512],"**Timing":[443],"Attacks:**":[444],"Intrusions":[445],"timed":[448],"coincide":[450],"weekends,":[452],"holidays,":[453],"or":[454,538],"periods":[455],"reduced":[457],"oversight.":[459],"\"off-hours\"":[461],"strategy":[462],"maximizes":[463],"window":[465],"opportunity":[467],"before":[468,494,578],"detection":[469,476,510,688],"response":[471,478],"teams":[472],"can":[473,584],"mobilize,":[474],"making":[475],"significantly":[479],"more":[480],"difficult.":[481],"**Testing":[483],"Probing:**":[485],"utilize":[487],"low-value":[488],"transactions":[489],"test":[491],"compromised":[492],"systems":[493],"attempting":[495],"larger":[496],"transfers.":[498],"allows":[500],"them":[501],"validate":[503],"avoid":[507],"triggering":[508],"fraud":[509],"thresholds.":[511],"**Repeat":[513],"Targeting:**":[514],"The":[515,561,636,712],"persistence":[516],"returning":[520],"entities":[524,703],"suggests":[525],"high":[527],"degree":[528],"reconnaissance":[530],"willingness":[533],"organizational":[536],"complacency":[537],"delayed":[539],"remediation":[540],"efforts.":[541],"Defense**To":[546],"counter":[547],"threats,":[550],"must":[553,653],"adopt":[554],"proactive":[556],"posture.":[560],"emphasizes":[563],"necessity":[565],"defensive":[572],"purposes\u2014simulating":[573],"identify":[576],"do.":[581],"help":[585],"organizations":[586],"detect":[591],"anomalous":[592],"behavior,":[593],"scripts":[600],"hackers.":[603],"Traditional,":[604],"human-dependent":[605],"measures":[607],"insufficient":[609],"against":[610],"adversaries":[611],"capable":[612],"automating":[614],"reconnaissance,":[615],"exploitation,":[616],"lateral":[618],"movement.":[619],"**Recommendations":[620],"Conclusion**The":[622],"cyberattacks":[626],"poses":[627],"systemic":[629],"risk":[630],"sector.":[635],"ability":[637],"defenses":[646],"real-time":[648],"means":[649],"move":[654],"away":[655],"reactive":[657],"postures":[659],"embrace":[661],"continuous":[662],"monitoring,":[663],"rapid":[664],"management,":[666],"AI-integrated":[668],"defense":[669],"strategies.":[670],"Key":[671],"recommendations":[672],"include":[673],"strict":[674],"enforcement":[675],"authentication":[677],"protocols":[678],"all":[680],"APIs,":[682],"implementation":[683],"24/7":[685],"AI-based":[686],"anomaly":[687],"rigorous":[691],"vetting":[692],"Failure":[696],"address":[698],"leaves":[701],"exposed":[704],"financial,":[707],"operational,":[708],"reputational":[710],"damage.":[711],"future":[720],"concern":[721],"present":[724],"reality":[725],"demands":[727],"immediate":[728],"sustained":[730],"community.":[736],"**Keywords:**":[737],"Cybersecurity,":[738],"Intelligence,":[740,747],"Sector,":[742],"Banking,":[743],"Vulnerabilities,":[745],"FinTech,":[748],"Crafty":[749],"Falcon,":[750],"Automated":[751],"Cyberattacks,":[752],"Fund":[753],"Transfer":[754],"Fraud,":[755],"CERT":[756],"Advisories,":[757],"Defense.":[759]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-11-07T00:00:00"}