Storm-3358 uses ARTEX to target financial organisations

In October 2026, the financially motivated threat actor Storm-3358 expanded its operations by leveraging the agentic AI framework ARTEX to target financial organisations, Microsoft Threat Intelligence reports. The Cambodia-based intrusion cluster focuses primarily on financial institutions in Southeast Asia but has also affected a smaller number of large financial organisations worldwide.

According to Microsoft, ARTEX is used alongside conventional automated tools to scan internet-connected systems, exploit vulnerabilities (including anonymous file upload and server-side request forgery), and install open‑source remote access trojans.

ARTEX agents have been observed deploying persistence and movement tools such as the WISP, vshell and AdaptixC2 RATs, with utilities like netcat and curl used to download these RATs to compromised hosts. In recent campaigns, threat actors used ARTEX to scan and exploit web applications, deploy web shells for persistence on compromised web servers, harvest credentials from public sources and compromised systems, and abuse compromised cloud identities for persistence and data exfiltration.

The actor also conducts brute-force password attacks, password spraying, API enumeration and database dumping to facilitate lateral movement and data theft. Microsoft highlights that threat actors frequently rely on proxies and VPNs to mask source IPs, and provides IOCs to assist defenders. The report notes that ARTEX activity aligns with a broader trend of AI-accelerated attack chains, underscoring the need for defenders to employ AI-enabled investigation and response across large environments. The IOCs list several ARTEX and WISP servers with first seen data in early November 2026.