ARTEX · CMP-202611-2c2zog · Infrastructure
NO FIX YET · SEE WHAT TO DO
Microsoft Threat Intelligence (6 Nov 2026): since October 2026 the financially motivated, Cambodia-based intrusion cluster Storm-3358 has used the agentic AI offensive framework ARTEX, together with conventional automated tools, against financial organizations, mainly in Southeast Asia and some large financial organizations globally. ARTEX agents scan internet-facing systems, exploit anonymous file upload and server-side request forgery (SSRF), then use netcat and curl to download open-source remote-access tools (WISP, vshell, AdaptixC2) for persistence and lateral movement. Related ARTEX attacks also use web shells, stolen credentials, compromised cloud identities, brute force and password spraying, API abuse and database dumping. Named victims, CVEs and affected products: not published. This is a separate actor from the Check Point ARTEX cybercrime operators, VAPOR PANDA and Storm-0940.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares campaign
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.