ARTEX AI Framework Used by Storm-3358 in Financial Sector Attacks

In October 2026, the financially motivated group Storm-3358 started targeting financial‑sector organizations with the agentic AI offensive framework ARTEX (Microsoft Security Blog).

Microsoft Threat Intelligence attributes Storm-3358 to a Cambodia‑based intrusion cluster that focuses on Southeast Asian financial firms and a smaller set of large global institutions.

The actor pairs ARTEX with conventional automation to scan internet‑exposed systems, exploit flaws such as anonymous file upload and server‑side request forgery, and drop open‑source remote‑access trojans.

For persistence and lateral movement, Storm-3358 deploys malware including the WISP, vshell and AdaptixC2 remote‑access trojans.

Microsoft observed ARTEX agents leveraging common utilities like netcat and curl to fetch these payloads onto compromised hosts.

Recent attacks show the framework scanning and exploiting web‑application vulnerabilities, planting web shells for persistence, stealing credentials and abusing cloud identities for data exfiltration.

Agentic tools such as ARTEX can use compromised credentials and systems at machine speed to move laterally, elevate privileges and extract data across large environments.

To aid defenders, Microsoft is releasing indicators of compromise while noting that defenders will need to deploy AI‑driven investigation and response at scale.

The deployment of the ARTEX framework by Storm-3358 suggests that threat actors are operationalizing agentic AI to accelerate multiple stages of the attack chain in targeted sectors. By automating tasks such as vulnerability scanning, credential compromise, and privilege escalation at machine speed, such frameworks reduce the time required to execute complex intrusions. This trend indicates that traditional static defenses will likely need to be supplemented by behavioral detection mechanisms capable of recognizing the distinct patterns of automated agent activity.

Spotted an error? See our corrections policy or email editorial@lordofclaude.com.