In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework known as ARTEX. This group primarily focuses on financial organizations in Southeast Asia, with some global targets.
Storm-3358 is a Cambodia-based intrusion cluster. Microsoft has observed the group using ARTEX in combination with conventional automated tools to scan systems connected to the public internet. The exploitation status of these activities is confirmed.
The group exploits security flaws such as anonymous file upload and server-side request forgery (SSRF), installing open-source remote access trojans (RATs) like WISP, vshell, and AdaptixC2 for persistence and lateral movement.
ARTEX agents are capable of performing brute-force password attacks, password spraying, API enumeration and abuse, and database dumping. Threat actors have compromised credentials from public sources and systems for persistence and data exfiltration.
Microsoft is providing indicators of compromise (IOCs) to help defenders detect related activity from ARTEX. Their continuous research into threat actors leveraging agentic frameworks is integrated into Microsoft's security products.