Microsoft says Cambodia-based Storm-3358 uses ARTEX agents against financial firms

Microsoft says a financially motivated group it tracks as Storm-3358 began attacking financial organisations in October with the agentic AI offensive framework ARTEX, according to a Microsoft Threat Intelligence post. Storm-3358 is a Cambodia-based intrusion cluster that mainly targets financial organisations in Southeast Asia, along with a smaller number of large financial organisations globally.

Microsoft said the group used ARTEX with conventional automated tools to scan internet-facing systems, exploit flaws such as anonymous file upload and server-side request forgery, and install the open-source remote access trojans WISP, vshell and AdaptixC2. ARTEX agents used utilities such as netcat and curl to download those trojans onto compromised systems.

The company called the activity part of an ongoing trend of attackers speeding up every stage of the attack chain with agentic penetration testing frameworks. It published indicators of compromise and listed signals that point to an AI agent at work, such as a wide variety of requests in a short time and retries at machine speed. Honeypots, decoys, tarpits and fake wins can pull autonomous attacks away from real targets, Microsoft said, and in its testing these controls reduced the attack traffic reaching real assets.