Microsoft says the financially motivated group Storm-3358 began targeting financial organizations with ARTEX in October 2026. The company describes the Cambodia-based group as focused mainly on financial organizations in Southeast Asia, with a smaller number of large financial organizations elsewhere. Its report details the campaign and defensive guidance.
How Microsoft describes the attack
Microsoft calls ARTEX an agentic AI framework for offensive penetration testing. It says Storm-3358 used it alongside conventional automated tools to scan internet-connected systems and exploit flaws, including anonymous file-upload vulnerabilities and server-side request forgery (SSRF), a technique that can make a server send requests to other systems.
Microsoft reports that the activity also involved web shells, credential and compromised cloud-identity abuse, brute-force attacks, password spraying, API enumeration and abuse, and database dumping. It says the actors used the remote access trojans (RATs) WISP, vshell, and AdaptixC2 for persistence and lateral movement, downloading them with tools including netcat and curl.
Behavioral signals and defensive measures
Microsoft says defenders should look for bursts of varied requests, repeated attempts that change technique, and rapid movement to later stages of an attack. The activity may use familiar tools such as Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright. Tool signatures can change, so blocking default characteristics alone will not stop an adaptive agent.
Microsoft says honeypots, decoys, tarpits, and “fake wins” reduced traffic reaching real assets in its testing. These measures aim to divert or slow automated activity. Microsoft also cautions that proxies and VPNs can change source IP addresses, curl has legitimate uses, and alerts may be unrelated to an intrusion.
Treat an indicator match as a lead: investigate the surrounding behavior and local context before drawing conclusions.
Why the two IP addresses matter
Microsoft’s Sentinel query includes 178.15.54.129. Its indicator table instead labels 178.16.54.129 an ARTEX server, with a first-seen date of October 19, 2026. Those are different IP addresses. The table marked its listed indicators active as of November 6, 2026.
A query entry does not make 178.15.54.129 interchangeable with the table’s 178.16.54.129 entry. Microsoft’s table identifies the latter as an ARTEX server; the query’s .15 address is not classified that way in the table. Treat each address as a separate value when investigating activity.
