ARTEX Agentic AI Framework Weaponized Against Financial Sector by Storm-3358
In October 2026, Microsoft Threat Intelligence identified Storm-3358, a Cambodia-based financially motivated threat actor, deploying the agentic AI offensive framework ARTEX against financial sector organizations across Southeast Asia and globally. The campaign combined AI-driven automated scanning, exploitation of vulnerabilities including anonymous file upload and server-side request forgery (SSRF), and installation of open-source remote access trojans (WISP, vshell, AdaptixC2) for persistence and lateral movement. ARTEX agents leveraged compromised credentials and cloud identities at machine speed to escalate privileges and exfiltrate sensitive financial data, representing a significant escalation in AI-augmented attack capabilities targeting the financial sector. This incident marks a pivotal shift in the threat landscape: agentic AI frameworks now enable threat actors to compress the entire attack chain—from initial reconnaissance to data exfiltration—into minutes rather than days. As financially motivated groups adopt AI-native offensive tooling, defenders face compounding pressure to deploy equally adaptive, AI-informed security controls across hybrid and multi-cloud financial infrastructure.
Kill Chain
