Storm-3358 uses the ARTEX agentic AI framework to target financial organisations
- Severity
- High
- Sources
- 1
What happened
Storm-3358, a Cambodia-based intrusion cluster, began targeting financial organisations in October 2026 using the agentic offensive framework ARTEX alongside conventional automation. Observed exploitation includes anonymous file upload and server-side request forgery, with netcat and curl used to fetch WISP, vshell and AdaptixC2 RATs; ARTEX also performs brute-force, password spraying, API abuse and database dumping. Defenders should hunt for machine-speed request bursts and default tool fingerprints (Nmap, curl, wget, Python HTTP clients, headless Chromium via Playwright), apply the IOCs in Microsoft's report, and use Entra ID risk-based Conditional Access. No CVE IDs are given.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review sign-in risk detections and configure Conditional Access policies to require multifactor authentication or block access based on risk.
- Apply the indicators of compromise published by Microsoft to your detection tooling and review related endpoint alerts.
- Hunt for rapid, high-volume requests and default penetration-testing tool user agents in web and sign-in traffic.
- Consider deploying honeypots, decoys or tarpits to draw autonomous attacks away from real systems.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies