Storm-3358 uses ARTEX to target Southeast Asian financial institutions

Since October 2026, Microsoft Threat Intelligence has tracked Storm-3358, a financially motivated intrusion cluster it assesses to be based in Cambodia, using ARTEX alongside conventional automation against financial organizations, primarily in Southeast Asia. Microsoft observed exploitation of internet-facing applications and installation of remote access tools on compromised systems. Its report identifies no named banks, victim count or data encryption incident in Vietnam. [1]

A 9 November report in Thời Báo Ngân Hàng raised the cost and speed of AI tooling. For a bank’s security team, the immediate questions are which public applications can accept a file or make a server-side request, and whether responders can trace an inbound request to execution, outbound traffic or a privilege change. [6]

Separate campaigns using ARTEX

In the Storm-0940 case, Microsoft reported attempted sign-ins to more than 2,250 tenants following the Cloud Backup compromise. A distinct password-spray burst on 10–14 October targeted 327 accounts across eight organizations, generating over 151,000 failures and peaking at 2,900 failures per minute. Microsoft observed no successful authentication in that burst. In other Storm-0940 activity it observed multiple instances of privileged cloud access in under three hours. Keep tenant, account and sign-in event counts separate in the incident timeline. [3] [10]

In early November, Censys found 1,465 hosts with an exposed ARTEX console. Removing about 650 hosts in two blocks with repeated configurations left roughly 815 apparently distinct deployments. The survey looked for publicly exposed interfaces, so it misses private instances and can include authorized testing. Host geography, counts and configuration similarity are infrastructure leads. Operator counts, victim counts and compromise rates remain unknown. [4]

From public applications to operational access

ARTEX first appeared in July 2026 as a penetration-testing framework that connects to language models and orchestrates familiar tools. Agents plan, interpret outputs and choose follow-on actions. CrowdStrike found ARTEX configurations and Claude Code session histories on actor-controlled infrastructure in the Korean case. Censys reported that copies continued to circulate after the original public repository was removed. The original license gives no measure of an operation’s model, hosting or proxy costs. [2] [4]

In the Storm-3358 case, Microsoft observed anonymous file upload exploitation and server-side request forgery (SSRF), where the application makes a request on the attacker’s behalf. An uploaded file establishes a write. Responders still need to examine executability and the web service’s privileges. SSRF can reach an internal service if the application host is allowed to connect to it. Exploitation of public-facing applications maps to ATT&CK T1190. [1] [9]

Microsoft also observed Storm-3358 use WISP, vshell and AdaptixC2 for persistence and lateral movement. An investigative lead is a web worker or service identity acting outside its normal function and then contacting an external destination or another system. This sequence remains informative when a tool changes source addresses or overlaps with authorized testing. [1]

The ConnectWise case illustrates another entry path. With stolen credentials for a multitenant application, an actor can use permissions already granted to the app to call APIs without an interactive employee sign-in. User MFA remains important. Banks need separate controls for app-only permissions, credential lifecycle and anomalous access by workload identities. [3]

Hunting hypotheses for bank SOC teams

Start with customer and partner portals and public APIs that accept files or fetch URLs. Test these hypotheses against local telemetry. Use event order, asset ownership and change records to distinguish authorized activity from an incident. [1] [3] [5]

Normalize timestamps to UTC and preserve their original values. Behind a proxy, use forwarded IP fields only from trusted proxies. A WAF alert, user agent or matching IP can start an investigation. Host or identity evidence supports a compromise finding. Record missing telemetry and retention limits so periods with no coverage remain visible. [1] [3]

Response priorities for the first 72 hours

• First 24 hours. Have the SOC and application owners inventory public entry points and backend service privileges. Prioritize upload and URL-fetch functions and broadly privileged integrations. Preserve logs at risk of expiry. On confirmed unauthorized execution or app identity abuse, coordinate host isolation or disabling the affected access path under the incident response plan while preserving evidence. [1] [3]
• Hours 24 to 72. Restrict upload authorization, store files outside the webroot in non-executable storage and limit outbound destinations to business requirements. For exposed app identities, revoke or rotate affected credentials and review permissions for unauthorized credentials, consent and roles. Review resource access before setting the scope of notification. [3] [5] [7] [8]
• Before full restoration. Identify identities that can delete backups or change retention. Confirm an isolated or immutable copy remains available. Restore a representative service in a separated environment and record recovery time, data checks and reopening approval.

Control of hosts, cloud identities and backup administration can determine the extent of disruption if an intrusion escalates. Public reporting reviewed through 10 November 2026 establishes regional targeting and observed intrusion techniques for Storm-3358. Victims in Vietnam and any encryption impact remain unconfirmed. [1]