Storm-3358 uses ARTEX against financial sector
Original title: ARTEX abuse expands as cybercriminals target financial sector
Cambodia-based Storm-3358 cluster deploys agentic AI framework ARTEX to scan exploit and install RATs in financial organizations across Southeast Asia.
In October 2026 Storm-3358 a Cambodia-based intrusion cluster began targeting financial organizations using ARTEX an agentic AI offensive framework. The actor combined ARTEX with automated tools to scan public internet systems exploit flaws such as anonymous file upload and SSRF and install open-source RATs including WISP vshell and AdaptixC2 for persistence and lateral movement. ARTEX agents also performed credential compromise brute-force attacks and data exfiltration accelerating attack chains with AI-driven techniques.
Unconfirmed: Exact number of victims and full scope of data exfiltrated not disclosed
- Storm-3358 primarily targets Southeast Asian financial organizations with global reach
- ARTEX uses Nmap curl Playwright and other penetration testing tools
- RATs downloaded via netcat and curl enable persistence
- Defenders should monitor for agentic scanning patterns and use honeypots
- Microsoft provides IOCs for ARTEX-related activity
Impact: remote code execution via web app exploits and credential abuse leading to data exfiltration
| Product | Affected |
|---|---|
| Microsoft Entra ID Protection Defender for Endpoint | — |
| financial sector organizations | — |
- 1.Monitor for agentic AI scanning patterns
- 2.Deploy defensive honeypots and tarpits
- 3.Investigate suspicious network traffic with Microsoft Entra ID Protection and Defender for Endpoint
- Vendors
- Microsoft
- Threat actors
- Storm-3358
- Countries
- Cambodia
- AI models
- ARTEX
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 178.15.54.129 | 9.95.67", "199.19.95.68", "91.92.240.238", "85.11.168.45", "178.15.54.129", "31.77.229.35", “85.11.167.52”]); _Im_NetworkSession(star |
| ipv4 | 178.16.54.129 | ]52 IP address C2 server 2026-11-04 Active as of 2026-11-06 178.16.54[.]129 IP address ARTEX server 2026-10-19 Active as of 2026-11-0 |
| ipv4 | 199.19.95.66 | d activity. Indicator Type Description First seen Last seen 199.19.95[.]66 IP address WISP C2 node 2026-11-02 Active as of 2026-11-0 |
| ipv4 | 199.19.95.67 | IP address WISP C2 node 2026-11-02 Active as of 2026-11-06 199.19.95[.]67 IP address WISP C2 node 2026-11-02 Active as of 2026-11-0 |
| ipv4 | 199.19.95.68 | IP address WISP C2 node 2026-11-02 Active as of 2026-11-06 199.19.95[.]68 IP address WISP C2 node 2026-11-02 Active as of 2026-11-0 |
| ipv4 | 31.77.229.35 | IP address ARTEX server 2026-10-19 Active as of 2026-11-06 31.77.229[.]35 IP address ARTEX server 2026-10-28 Active as of 2026-11-0 |
| ipv4 | 85.11.167.52 | IP address ARTEX server 2026-11-04 Active as of 2026-11-06 85.11.167[.]52 IP address C2 server 2026-11-04 Active as of 2026-11-06 1 |
| ipv4 | 85.11.168.45 | IP address ARTEX server 2026-11-04 Active as of 2026-11-06 85.11.168[.]45 IP address ARTEX server 2026-11-04 Active as of 2026-11-0 |
| ipv4 | 91.92.240.238 | IP address WISP C2 node 2026-11-02 Active as of 2026-11-06 91.92.240[.]238 IP address ARTEX server 2026-11-04 Active as of 2026-11-0 |
From the original article
8 min read at microsoft.com
In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX. The post ARTEX abuse expands as cybercriminals target financial sector appeared first on Microsoft Security Blog.
By Microsoft Threat Intelligence · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.