# Storm-3358: ARTEX moves from spies to financial cybercrime

> Microsoft says a Cambodia-based criminal group now runs ARTEX agents against financial firms, widening abuse that began with state-aligned actors.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Attack
- **Published by:** Microsoft
- **Disclosed:** 2026-11-06
- **Affects:** ARTEX, Microsoft Entra ID
- **Research by:** Microsoft Threat Intelligence
- **Primary source:** https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
- **Page:** https://theinjection.dev/items/microsoft-storm-3358-artex-finance/

Microsoft Threat Intelligence reports Storm-3358, a Cambodia-based financially motivated group, began using the ARTEX agentic offensive framework in October 2026 against financial organizations in Southeast Asia.

## What happened

Microsoft Threat Intelligence published this campaign on November 6, 2026. Storm-3358, a Cambodia-based financially motivated cluster that Microsoft says targets financial organizations in Southeast Asia and, less often, large financial organizations worldwide, began using ARTEX in October 2026. Microsoft observed related attack activity from early October through early November 2026.

## How it works

ARTEX agents drive ordinary penetration-testing tools by default: Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright. Storm-3358 paired those agents with conventional automation to scan internet-facing systems, then exploited flaws such as anonymous file upload and server-side request forgery. Agents pulled remote access trojans onto compromised hosts with netcat and curl, and the operators kept their foothold with the open-source WISP, vshell and AdaptixC2 implants. Microsoft says agents can use stolen credentials and systems at machine speed to move laterally, escalate privileges and take data out.

## Who is affected

Financial organizations in Southeast Asia carry most of this group's attention. Exposed surfaces are internet-facing web applications and web servers, cloud identities, and identity and sign-in systems including Microsoft Entra ID. Microsoft names no specific vulnerable product or CVE and reports no victim count, and says most of the indicators it published were still active on November 6, 2026.

## What to do

Search your logs for the indicator addresses Microsoft published, and hunt on behaviour rather than fingerprints: many varied requests in a short period, retried technique variations, and very fast movement to next-stage actions. Microsoft reports that honeypots, decoys, tarpits and fake wins reduced attack traffic reaching real systems in its own testing. Turn on Entra ID Protection risk detections and use Conditional Access to require multifactor authentication or block risky sign-ins.

## Quick facts

- **Attack type:** Agentic reconnaissance and exploitation, then RAT deployment, credential harvesting and cloud identity abuse
- **Actor:** Storm-3358, a Cambodia-based financially motivated cluster, per Microsoft
- **Timeline:** ARTEX use began October 2026; related activity early October to early November 2026; indicators first seen October 19 to November 4, 2026
- **Status:** Most published indicators still active on November 6, 2026
- **Agent tooling:** Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, headless Chromium via Playwright; WISP, vshell and AdaptixC2 RATs
- **Found by:** Microsoft Threat Intelligence

## Questions

### How is Storm-3358 different from the other ARTEX activity Microsoft has reported?

Storm-3358 is financially motivated rather than state-aligned, which Microsoft presents as ARTEX abuse widening beyond espionage. Microsoft tracks the cluster as Cambodia-based and focused on financial organizations in Southeast Asia. Earlier Microsoft reporting covered the China state-aligned Storm-0940 and separate unattributed activity hunting exposed secrets on GitHub, each with different targets and tradecraft.

### Can blocking the ARTEX tool fingerprints stop these attacks?

Microsoft says no. Default user agents and other distinctive traffic traits from the tools ARTEX drives can reveal the activity, but Microsoft warns an agent can change them quickly, so blocking fingerprints alone will not stop it. Microsoft recommends detecting the behavioural pattern instead: high volumes of varied requests, retried technique variations and unusually fast progression between attack stages.

### Does deception actually work against autonomous attack agents?

Microsoft reports that honeypots, decoys, tarpits and fake wins reduced the attack traffic reaching real systems in its own testing, and produced high-confidence attribution signals. Microsoft names Microsoft Sentinel Deception as one option. That result is Microsoft's own measurement from internal testing rather than an independently published finding, so treat the size of the effect as its claim.

## Sources

1. [Microsoft Advisory](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/)
2. [Earlier ARTEX Report](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)