---
id: "CMP-202611-2c2zog"
page: "https://infrastack.ai/live/CMP-202611-2c2zog"
kind: "campaign"
aliases: []
title: "Cambodia-based Storm-3358 uses the ARTEX AI hacking tool to break into banks and other financial organizations through web flaws, then installs WISP, vshell and AdaptixC2 remote-access tools (Microsoft)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "ARTEX", "fixed": [], "ecosystem": "other"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-07T03:28:07+00:00"
updated_at: "2026-11-07T03:29:07+00:00"
sources: [{"source": "analyst", "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "first_seen_at": "2026-11-07T03:28:07+00:00", "cites": ["https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/"]}]
exploit_sources: []
---

# Cambodia-based Storm-3358 uses the ARTEX AI hacking tool to break into banks and other financial organizations through web flaws, then installs WISP, vshell and AdaptixC2 remote-access tools (Microsoft)

Link for people: https://infrastack.ai/live/CMP-202611-2c2zog (this .md is for agents)

Microsoft Threat Intelligence (6 Nov 2026): since October 2026 the financially motivated, Cambodia-based intrusion cluster Storm-3358 has used the agentic AI offensive framework ARTEX, together with conventional automated tools, against financial organizations, mainly in Southeast Asia and some large financial organizations globally. ARTEX agents scan internet-facing systems, exploit anonymous file upload and server-side request forgery (SSRF), then use netcat and curl to download open-source remote-access tools (WISP, vshell, AdaptixC2) for persistence and lateral movement. Related ARTEX attacks also use web shells, stolen credentials, compromised cloud identities, brute force and password spraying, API abuse and database dumping. Named victims, CVEs and affected products: not published. This is a separate actor from the Check Point ARTEX cybercrime operators, VAPOR PANDA and Storm-0940.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:ARTEX affected range not listed fixed no fixed version listed

## How to check

- Look in firewall, proxy, DNS and EDR logs for connections to Microsoft's indicators (all active as of 6 Nov 2026): WISP C2 199.19.95[.]66, 199.19.95[.]67, 199.19.95[.]68 (first seen 2 Nov); ARTEX servers 91.92.240[.]238 and 85.11.168[.]45 (4 Nov), 178.16.54[.]129 (19 Oct; Microsoft's Sentinel query lists it as 178.15.54.129, so check both), 31.77.229[.]35 (28 Oct); C2 server 85.11.167[.]52 (4 Nov). The actor uses proxies and VPNs, so attacks may also come from other IPs.
- On web servers, look for curl or netcat downloading new binaries, new web shells, unexpected cron jobs, and WISP, vshell or AdaptixC2 implants.
- Check web apps for anonymous file upload endpoints and SSRF.
- Look for bursts of many varied requests retried at machine speed, and default user agents of Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch or headless Chromium/Playwright.
- File hashes: not published.

## Fix

- Block and alert on the listed IPs.
- Turn off anonymous file upload, fix SSRF in internet-facing apps, and require authentication on APIs.
- If you find an implant or web shell, isolate the host, and rotate credentials and cloud identities it could reach.
- Use risk-based sign-in policies (MFA or block on risky sign-ins), and consider honeypots or decoys to soak up automated agent attacks.

## Timeline

- 2026-11-07T03:28:07+00:00 analyst https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/

## Documents

- [describes] @MsftSecIntel: Threat actors’ abuse of ARTEX continues to expand, with Microsoft Threat Intelli https://x.com/MsftSecIntel/status/2118898318457585943
- [describes] ARTEX abuse expands as cybercriminals target financial sector (Microsoft Threat Intelligence) https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_