ARTEX Abuse Expands as Cybercriminals Target Financial Sector
Microsoft, Friday, November 6th, 2026
Microsoft says Cambodia-based Storm-3358 began using the agentic AI framework ARTEX to attack financial organizations in October 2026.
Microsoft Threat Intelligence reports that Storm-3358, a financially motivated, Cambodia-based intrusion cluster, began targeting financial organizations with the agentic AI offensive framework ARTEX in October 2026.
The group mainly targets Southeast Asian financial firms plus some large global institutions.
It combines ARTEX with automated tools to scan internet-facing systems, exploit flaws such as anonymous file upload and SSRF, and install open-source RATs including WISP, vshell and AdaptixC2.
ARTEX agents can also brute force passwords, spray credentials, abuse APIs, dump databases and exfiltrate data, and Microsoft is publishing indicators of compromise.