Microsoft Reports Storm-3358 Using ARTEX to Target Financial Organizations
Summary
Microsoft says Storm-3358 used ARTEX in attacks on financial organizations, combining web application exploitation, web shells, compromised credentials and RATs. The report includes detection guidance, hunting queries and IOCs.
Key points
- Microsoft reports Storm-3358 began targeting financial organizations with ARTEX in October 2026, focusing primarily on Southeast Asia.
- The actor reportedly scanned internet-facing systems and exploited flaws including anonymous file upload and server-side request forgery.
- Microsoft observed use of WISP, vshell and AdaptixC2 RATs, as well as web shells and compromised cloud identities for persistence and data exfiltration.
- ARTEX agents can use tools such as Nmap, curl, wget and headless Chromium; Microsoft says rapid, varied requests and repeated technique variations can be behavioral signals.
- Microsoft's testing found honeypots, decoys, tarpits and fake wins reduced attack traffic reaching real assets and produced high-confidence signals.
- The article provides Microsoft Defender and Sentinel detection guidance, hunting queries and sample indicators, while warning that proxies and VPNs can change source IPs.
Article Details
- Event Type
- Reported cybercriminal campaign using the ARTEX agentic AI offensive framework to target financial-sector organizations.
- Impact
- Microsoft reports that Storm-3358 used ARTEX and conventional tools to scan and exploit systems, deploy remote access trojans, establish persistence, compromise credentials and cloud identities, move laterally, and exfiltrate data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 178[.]16[.]54[.]129 | Identified by Microsoft as an ARTEX server; reported active as of 2026-11-06. |
| IPV4 | 199[.]19[.]95[.]66 | Identified by Microsoft as a WISP C2 node; reported active as of 2026-11-06. |
| IPV4 | 199[.]19[.]95[.]67 | Identified by Microsoft as a WISP C2 node; reported active as of 2026-11-06. |
| IPV4 | 199[.]19[.]95[.]68 | Identified by Microsoft as a WISP C2 node; reported active as of 2026-11-06. |
| IPV4 | 31[.]77[.]229[.]35 | Identified by Microsoft as an ARTEX server; reported active as of 2026-11-06. |
| IPV4 | 85[.]11[.]167[.]52 | Identified by Microsoft as a C2 server; reported active as of 2026-11-06. |
| IPV4 | 85[.]11[.]168[.]45 | Identified by Microsoft as an ARTEX server; reported active as of 2026-11-06. |
| IPV4 | 91[.]92[.]240[.]238 | Identified by Microsoft as an ARTEX server; reported active as of 2026-11-06. |
MITRE ATT&CK
T1046 · Network Service DiscoveryStorm-3358 used ARTEX and conventional tools to scan systems connected to the public internet.T1078.004 · Cloud AccountsMicrosoft reports use of compromised cloud identities for persistence and data exfiltration.T1110 · Brute ForceMicrosoft reports that ARTEX agents can perform brute-force password attacks.T1110.003 · Password SprayingMicrosoft reports that ARTEX agents can perform password spraying.T1190 · Exploit Public-Facing ApplicationMicrosoft reports that Storm-3358 exploited security flaws in web applications, including anonymous file upload and SSRF.T1505.003 · Web ShellMicrosoft reports use of web shells to maintain persistence on compromised web servers.
Threat Actors
Malware
AdaptixC2Storm-3358 has used the WISP, vshell, and AdaptixC2 RATs for persistence and lateral movement.VshellStorm-3358 has used the WISP, vshell, and AdaptixC2 RATs for persistence and lateral movement.WISPStorm-3358 has used the WISP, vshell, and AdaptixC2 RATs for persistence and lateral movement.
Vendors
Products
Microsoft Defender for EndpointEndpoint activity — Microsoft Defender for EndpointMicrosoft Defender XDRInvestigate alerts in Microsoft Defender XDRMicrosoft Entra ID ProtectionIdentity and sign-in activity — Microsoft Entra ID ProtectionMicrosoft PurviewThe dashboard provides users with a unified view of AI security posture by aggregating security, identity, and data risk across Microsoft Defender, Microsoft Entra, and Microsoft Purview.Microsoft Security CopilotMicrosoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, andMicrosoft Sentinel DeceptionHoneypots and decoy surfaces such as Microsoft Sentinel Deception give the agent attractive but worthless targets to pursue.
Tools
ARTEXIn October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.curlMicrosoft has observed ARTEX agents using utilities like netcat and curl to download these RATs to compromised systems, as shown in Figure 1.netcatMicrosoft has observed ARTEX agents using utilities like netcat and curl to download these RATs to compromised systems, as shown in Figure 1.NmapFor example, ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright, among others.PlaywrightFor example, ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright, among others.wgetFor example, ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright, among others.