Microsoft: Storm-3358 group uses ARTEX AI in finance sector attacks

Microsoft security officials reported observing the activity of a financially motivated threat actor named Storm-3358 in October 2026. Based in Cambodia, this group primarily targets financial institutions in Southeast Asia as well as major banks worldwide. Analysts determined that the group is utilizing a framework known as ARTEX.

According to Microsoft data, Storm-3358 uses ARTEX alongside standard automated tools. The group attempts to gain access to systems by scanning internet-connected systems, uploading anonymous files, and exploiting vulnerabilities such as Server-Side Request Forgery (SSRF). Attackers install open-source remote access trojans like WISP, vshell, and AdaptixC2 to establish persistent presence and lateral movement within systems.

ARTEX agents utilize tools such as netcat and curl to upload these trojans to compromised systems. In recent attacks, the group employed methods including discovering vulnerabilities in web applications, maintaining presence via web shells, and using passwords obtained from open sources. Compromised cloud identifiers were also observed for data exfiltration.

These AI-based tools enable threat actors to perform lateral movement, privilege escalation, and data exfiltration at machine speed within compromised systems. This situation demonstrates a persistent trend where threat actors accelerate all stages of the attack chain using AI. Microsoft emphasized that defenders must also use AI for analysis and response in large-scale environments.

Microsoft provided a series of recommendations for defense. AI frameworks send various requests in a short time and repeat the same method. Honeypots and decoy tools help divert autonomous attacks away from real targets. Microsoft Sentinel Deception provides agents with attractive but useless targets, reducing attack traffic.

The company offers detection capabilities for similar activities in its products, such as Microsoft Entra ID Protection and Defender for Endpoint. These tools analyze personal identifiers and system activity to help identify risky access. Microsoft stated it will continue monitoring these threats and providing customers with new capabilities to strengthen security.