سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
Canonical Run ID
ACRIP-MFI-20261101T143100Z-5D92B4E1
ناجح · PASS
What ran?GENERAL_DISCOVERY
Discover the highest-value new CY-DOM-001 development in the last 7 days; rank by freshness + technical impact + evidence strength + real-world exploitation + defensive value.
Why this Topic?Indian NBFC Payment/Disbursement API Fraud — Trusted-Infrastructure Payout Abuse
Selected Indian NBFC payment/disbursement API fraud 25/25; official campaign mechanics + fresh reported scale delta + independent mechanism-consistent incident; scale/tool attribution and regional projection bounded.
EVIDENCE
الأدلة وما تثبته
4 سجل
MFI-E-0065
CERT-In/CSIRT-Fin confirmed multiple campaigns against NBFCs, digital lenders, fintechs, payment providers and wallet operators in which attackers compromise exposed applications/APIs or credentials, then invoke payout APIs from trusted infrastructure to bypass application-level controls and route funds to mule accounts.
UNKNOWN
Supports
Officially observed payment/disbursement API abuse, business-control bypass, mule-account routing and defensive control requirements.
Does not prove
Official aggregate loss/victim denominator, one universal CVE/product, complete IOC set, one actor identity or universal AI/tool attribution.
Confidence
غير مسجل
Context
Official active-campaign advisory
CERT-In / CSIRT-Finفتح المصدرCY-T1 / Government CERT
MFI-E-0066
CERT-In confirmed financially motivated abuse of open-source agentic offensive frameworks, machine-speed exploitation of conventional weaknesses and repeat attacks after incomplete remediation; BFSI entities are directed to payment/disbursement API controls in CIAD-2026-0046.
{"Notes":"Possible AI-assisted tooling ≠ universal ARTEX/CyberStrike identity.","Gap ID":"CY-GAP-MFI-5D92B4E1-02","Impact":"Blocks universal tool/operator/actor claims and nationality inference.","Status":"OPEN","Gap Type":"TOOL_ACTOR_ATTRIBUTION","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-MFI-5D92B4E1","Description":"Evidence linking specific payment-API incidents to ARTEX, CyberStrike or a named operator remains incomplete/source-qualified.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101T143100Z-5D92B4E1","Required Evidence / Resolution":"Incident-specific controller/session artifacts, infrastructure control evidence, tool fingerprints and independent attribution."}
FOLLOW-UP
المتابعات غير المحسومة
4 مفتوحة
SCALE_DENOMINATOR
Official consolidated count of affected institutions, successful incidents and confirmed monetary losses remains unavailable.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
TOOL_ACTOR_ATTRIBUTION
Evidence linking specific payment-API incidents to ARTEX, CyberStrike or a named operator remains incomplete/source-qualified.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
INITIAL_ACCESS_INFRASTRUCTURE
No complete public set of incident-specific initial-access CVEs/products, attacker infrastructure or IOCs was recovered.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
JORDAN_MENA_PROJECTION
No direct Jordan/MENA victim/provider/payment telemetry, matched infrastructure or authority reporting links this specific Indian payment-API campaign to the region.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
PASS — MFI SSOT + CENTRAL REGISTRY + COMMIT JOURNAL + MFI affected Hot-Start v1.4 slices read back exactly. Canonical Run/Topic/4 Gaps/Snapshot/12 edges unique and non-orphan. A later foreign VEI commit became COMMITTED after the MFI projection readback; per concurrency policy it does not roll back or invalidate MFI run-scoped closure and its owner is responsible for advancing global Tier-0. Protected Core unchanged. Run doc: https://docs.google.com/document/d/1sYnd3xyuXVCj5Duy5cG_eRoLQA_x0ofOH9_xt_RRwRg/edit
ET reported an estimated ~₹300 crore siphoned from mostly smaller NBFCs over roughly two months with nearly 150 complaints/FIRs, repeat attacks at some institutions and source-qualified references to CyberStrike/ARTEX-related tooling in completed investigations.
ASSESSMENT
Supports
Fresh source-attributed scale estimate and repeated-attack context.
Does not prove
Official CERT-In/RBI aggregate, one-campaign identity, universal AI/tool use or exact institution denominator.
Confidence
غير مسجل
Context
Source-attributed investigative reporting
The Economic Timesفتح المصدرCY-T4 / Reputable Investigative Reporting
MFI-E-0068
Police-sourced reporting describes unauthorized access to an NBFC’s systems/API followed by 183 disbursements totaling ~₹3.3 crore to 52 suspected beneficiary accounts in 87 minutes; ~₹40 lakh was reportedly blocked.
UNKNOWN
Supports
Independent mechanism-consistent rapid API payout/mule-account incident.
Does not prove
Same operator/infrastructure/exploit/AI tooling as other incidents or final root cause.
Confidence
غير مسجل
Context
Police-sourced incident reporting
Times of India / Telangana Cyber Security Bureauفتح المصدرCY-T3 / Police-Sourced Reputable Reporting
{"Notes":"CERT-In describes multiple initial-access classes rather than one universal exploit.","Gap ID":"CY-GAP-MFI-5D92B4E1-03","Impact":"Blocks precise exploit-path reconstruction, infrastructure continuity and targeted hunting across the full wave.","Status":"OPEN","Gap Type":"INITIAL_ACCESS_INFRASTRUCTURE","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-MFI-5D92B4E1","Description":"No complete public set of incident-specific initial-access CVEs/products, attacker infrastructure or IOCs was recovered.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101T143100Z-5D92B4E1","Required Evidence / Resolution":"Victim IR, CERT incident annexes, passive DNS/hosting history, web-shell/sample hashes and authenticated API/application logs."}
{"Notes":"Negative-space result is not proof of regional absence.","Gap ID":"CY-GAP-MFI-5D92B4E1-04","Impact":"Blocks local campaign/prevalence/attribution claims while preserving defensive relevance.","Status":"OPEN","Gap Type":"JORDAN_MENA_PROJECTION","Priority":"HIGH","Domain ID":"CY-DOM-001","Topic IDs":"CY-TOP-MFI-5D92B4E1","Description":"No direct Jordan/MENA victim/provider/payment telemetry, matched infrastructure or authority reporting links this specific Indian payment-API campaign to the region.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MFI-20261101T143100Z-5D92B4E1","Required Evidence / Resolution":"Jordan/MENA bank/fintech incident records, gateway/API logs, mule-account graphs, matched IOCs/infrastructure and authoritative reporting."}
NEW — official CERT-In/CSIRT-Fin campaign mechanics verified; fresh reported scale delta and independent rapid-disbursement case recovered; national denominator, tool/actor attribution, initial-access infrastructure and Jordan/MENA projection remain gated.