{"id":"CMP-202611-2c2zog","kind":"campaign","aliases":[],"related":["CMP-202611-57y43e"],"title":"Cambodia-based Storm-3358 uses the ARTEX AI hacking tool to break into banks and other financial organizations through web flaws, then installs WISP, vshell and AdaptixC2 remote-access tools (Microsoft)","description":null,"summary":"Microsoft Threat Intelligence (6 Nov 2026): since October 2026 the financially motivated, Cambodia-based intrusion cluster Storm-3358 has used the agentic AI offensive framework ARTEX, together with conventional automated tools, against financial organizations, mainly in Southeast Asia and some large financial organizations globally. ARTEX agents scan internet-facing systems, exploit anonymous file upload and server-side request forgery (SSRF), then use netcat and curl to download open-source remote-access tools (WISP, vshell, AdaptixC2) for persistence and lateral movement. Related ARTEX attacks also use web shells, stolen credentials, compromised cloud identities, brute force and password spraying, API abuse and database dumping. Named victims, CVEs and affected products: not published. This is a separate actor from the Check Point ARTEX cybercrime operators, VAPOR PANDA and Storm-0940.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-07T03:28:07+00:00","products":[{"name":"ARTEX","fixed":[],"ecosystem":"other"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Look in firewall, proxy, DNS and EDR logs for connections to Microsoft's indicators (all active as of 6 Nov 2026): WISP C2 199.19.95[.]66, 199.19.95[.]67, 199.19.95[.]68 (first seen 2 Nov); ARTEX servers 91.92.240[.]238 and 85.11.168[.]45 (4 Nov), 178.16.54[.]129 (19 Oct; Microsoft's Sentinel query lists it as 178.15.54.129, so check both), 31.77.229[.]35 (28 Oct); C2 server 85.11.167[.]52 (4 Nov). The actor uses proxies and VPNs, so attacks may also come from other IPs.\n- On web servers, look for curl or netcat downloading new binaries, new web shells, unexpected cron jobs, and WISP, vshell or AdaptixC2 implants.\n- Check web apps for anonymous file upload endpoints and SSRF.\n- Look for bursts of many varied requests retried at machine speed, and default user agents of Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch or headless Chromium/Playwright.\n- File hashes: not published.","fix":"- Block and alert on the listed IPs.\n- Turn off anonymous file upload, fix SSRF in internet-facing apps, and require authentication on APIs.\n- If you find an implant or web shell, isolate the host, and rotate credentials and cloud identities it could reach.\n- Use risk-based sign-in policies (MFA or block on risky sign-ins), and consider honeypots or decoys to soak up automated agent attacks.","status":"open","published_at":null,"first_seen_at":"2026-11-07T03:28:07+00:00","triaged_at":"2026-11-07T03:28:07+00:00","updated_at":"2026-11-07T03:29:07+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0940':174B '-2':36A '-202611':35A '-3358':5A,61B '2026':48B,51B '6':46B 'abus':146B 'access':31A,118B 'actor':162B 'adaptixc2':28A,122B 'affect':154B 'agent':65B,89B 'ai':9A,66B 'also':131B 'anonym':96B 'api':145B 'artex':8A,38A,69B,88B,129B,167B 'asia':81B 'attack':130B 'autom':73B 'bank':15A 'base':3A,57B 'break':13A 'brute':140B 'c2zog':37A 'cambodia':2A,56B 'cambodia-bas':1A,55B 'campaign':39B 'check':165B 'cloud':138B 'cluster':59B 'cmp':34A 'compromis':137B 'convent':72B 'credenti':136B 'curl':110B 'cves':152B 'cybercrim':168B 'databas':148B 'download':112B 'dump':149B 'earli':41B 'early-warn':40B 'exploit':95B 'face':93B 'file':97B 'financi':18A,53B,76B,85B 'flaw':22A 'forc':141B 'forgeri':104B 'framework':68B 'global':87B 'hack':10A 'ident':139B 'instal':24A 'intellig':45B 'internet':92B 'internet-fac':91B 'intrus':58B 'larg':84B 'later':126B 'main':78B 'microsoft':33A,43B 'motiv':54B 'movement':127B 'name':150B 'netcat':108B 'nov':47B 'octob':50B 'offens':67B 'open':114B 'open-sourc':113B 'oper':169B 'organ':19A,77B,86B 'panda':171B 'password':143B 'persist':124B 'point':166B 'product':155B 'publish':157B 'relat':128B 'remot':30A,117B 'remote-access':29A,116B 'request':103B 'scan':90B 'separ':161B 'server':101B 'server-sid':100B 'shell':134B 'side':102B 'sinc':49B 'sourc':115B 'southeast':80B 'spray':144B 'ssrf':105B 'stolen':135B 'storm':4A,60B,173B 'system':94B 'threat':44B 'togeth':70B 'tool':11A,32A,74B,119B 'upload':98B 'use':6A,63B,107B,132B 'vapor':170B 'victim':151B 'vshell':26A,121B 'warn':42B 'web':21A,133B 'wisp':25A,120B","nicknames":["Storm-3358"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["artex","storm3358"],"ptokens":["artex"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"exploitation","search_a":"'-2':36A '-202611':35A '-3358':5A 'access':31A 'adaptixc2':28A 'ai':9A 'artex':8A,38A 'bank':15A 'base':3A 'break':13A 'c2zog':37A 'cambodia':2A 'cambodia-bas':1A 'cmp':34A 'financi':18A 'flaw':22A 'hack':10A 'instal':24A 'microsoft':33A 'organ':19A 'remot':30A 'remote-access':29A 'storm':4A 'tool':11A,32A 'use':6A 'vshell':26A 'web':21A 'wisp':25A","search_b":"'-0940':174B '-3358':61B '2026':48B,51B '6':46B 'abus':146B 'access':118B 'actor':162B 'adaptixc2':122B 'affect':154B 'agent':65B,89B 'ai':66B 'also':131B 'anonym':96B 'api':145B 'artex':69B,88B,129B,167B 'asia':81B 'attack':130B 'autom':73B 'base':57B 'brute':140B 'cambodia':56B 'cambodia-bas':55B 'campaign':39B 'check':165B 'cloud':138B 'cluster':59B 'compromis':137B 'convent':72B 'credenti':136B 'curl':110B 'cves':152B 'cybercrim':168B 'databas':148B 'download':112B 'dump':149B 'earli':41B 'early-warn':40B 'exploit':95B 'face':93B 'file':97B 'financi':53B,76B,85B 'forc':141B 'forgeri':104B 'framework':68B 'global':87B 'ident':139B 'intellig':45B 'internet':92B 'internet-fac':91B 'intrus':58B 'larg':84B 'later':126B 'main':78B 'microsoft':43B 'motiv':54B 'movement':127B 'name':150B 'netcat':108B 'nov':47B 'octob':50B 'offens':67B 'open':114B 'open-sourc':113B 'oper':169B 'organ':77B,86B 'panda':171B 'password':143B 'persist':124B 'point':166B 'product':155B 'publish':157B 'relat':128B 'remot':117B 'remote-access':116B 'request':103B 'scan':90B 'separ':161B 'server':101B 'server-sid':100B 'shell':134B 'side':102B 'sinc':49B 'sourc':115B 'southeast':80B 'spray':144B 'ssrf':105B 'stolen':135B 'storm':60B,173B 'system':94B 'threat':44B 'togeth':70B 'tool':74B,119B 'upload':98B 'use':63B,107B,132B 'vapor':170B 'victim':151B 'vshell':121B 'warn':42B 'web':133B 'wisp':120B","search_c":"","first_public_at":"2026-11-06T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-2c2zog","url":"https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-07T03:28:07+00:00","fetched_at":"2026-11-07T03:28:07+00:00","note":null,"cites":["https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/"]}],"documents":[{"id":92215,"url":"https://x.com/MsftSecIntel/status/2118898318457585943","title":"@MsftSecIntel: Threat actors’ abuse of ARTEX continues to expand, with Microsoft Threat Intelli","kind":"post","source":"x","publisher":null,"text":"Threat actors’ abuse of ARTEX continues to expand, with Microsoft Threat Intelligence observing financially motivated Storm-3358 using the agentic AI offensive framework alongside conventional automated tools to target financial organizations. https://t.co/OWnmxGeEy0\n\nStorm-3358\n\nlikes 54 reposts 24","published_at":"2026-11-07T02:48:21+00:00","relation":"describes","confidence":null,"note":null},{"id":92372,"url":"https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/","title":"ARTEX abuse expands as cybercriminals target financial sector (Microsoft Threat Intelligence)","kind":"blog","source":"analyst","publisher":null,"text":"Microsoft Threat Intelligence (6 Nov 2026): since October 2026 the financially motivated, Cambodia-based intrusion cluster Storm-3358 uses the agentic AI offensive framework ARTEX with conventional automated tools against financial organizations, mainly in Southeast Asia plus a smaller number of large financial organizations globally. Scans internet-facing systems, exploits anonymous file upload and SSRF, installs open-source RATs WISP, vshell and AdaptixC2 (downloaded by ARTEX agents with netcat and curl) for persistence and lateral movement; web shells, credential theft, cloud identity abuse, brute force, password spraying, API abuse, database dumping. ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, headless Chromium via Playwright (default user agents). IOCs: 199.19.95[.]66, 199.19.95[.]67, 199.19.95[.]68 WISP C2 (first seen 2026-11-02); 91.92.240[.]238, 85.11.168[.]45 ARTEX servers (2026-11-04); 85.11.167[.]52 C2 (2026-11-04); 178.16.54[.]129 ARTEX server (2026-10-19; the Sentinel query lists 178.15.54.129); 31.77.229[.]35 ARTEX server (2026-10-28); all active as of 2026-11-06. Mitigations: Entra ID Protection risk policies, deception/honeypots/tarpits.","published_at":"2026-11-06T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}