A financially motivated hacking group based in Cambodia has started pointing an AI attack agent at banks. Microsoft Threat Intelligence says the cluster it tracks as Storm-3358 began targeting financial sector organizations in October 2026 with ARTEX, the agentic offensive framework that has turned up in a string of intrusions over the past two months.
The shift matters because ARTEX does not just help a human operator. Its agents scan, exploit, steal credentials and move through networks on their own, retrying and switching techniques at what Microsoft calls machine speed. Microsoft frames this as ARTEX abuse expanding, and Storm-3358 is a financially motivated crew rather than a spy outfit.
A crew that mostly hunts Southeast Asian banks
According to Microsoft's report, Storm-3358 primarily targets financial organizations in Southeast Asia, plus a smaller number of large financial organizations globally. Microsoft has not named victims. Beyond calling it a Cambodia-based intrusion cluster, Microsoft has not published further detail on who is behind it.
The pattern echoes earlier ARTEX reporting against the finance sector, including the intrusions at South Korean financial firms covered in October. Microsoft does not link Storm-3358 to those operators, and neither should readers.
Open-source RATs, delivered by the agent itself
Microsoft says Storm-3358 pairs ARTEX with conventional automated tools to scan systems exposed to the internet and exploit weaknesses including anonymous file upload and server-side request forgery (SSRF, a bug that tricks a server into making requests on the attacker's behalf). Once inside, the crew installs open-source remote access trojans: WISP, vshell and AdaptixC2, used for persistence and lateral movement. Microsoft observed ARTEX agents themselves using netcat and curl to pull those RATs onto compromised machines.
Across recent ARTEX-related attacks more broadly, Microsoft has seen the agents exploit web application flaws, park web shells on compromised servers, harvest credentials from public sources and breached systems, and lean on compromised cloud identities for persistence and data theft. The framework can also brute-force and spray passwords, enumerate and abuse APIs, and dump databases. Days earlier Microsoft documented an ARTEX agent that went from a leaked GitHub secret to an Azure key vault in minutes.
Spot the tooling, then waste the agent's time
Microsoft's defensive advice is specific to how agents behave. Agentic scanners fire a wide variety of requests in a short window and either retry variations of the same technique or jump to next-stage actions almost instantly. ARTEX by default drives familiar tools, including Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright, which can leave distinctive traffic such as default user agent strings. Blocking those strings will not stop an agent that simply changes them, Microsoft warns, but spotting them can tip defenders off.
The more interesting recommendation is deception. Honeypots and decoy assets give the agent worthless targets, tarpits burn its time and budget, and fake wins can convince it the objective is done so it stops. Microsoft says that in its own testing these controls reduced attack traffic reaching real assets and produced high-confidence signal for attribution. The report also lists Defender detections and hunting queries, including one for new files downloaded with curl.
Indicators published by Microsoft
- WISP C2 nodes: 199[.]19[.]95[.]66, 199[.]19[.]95[.]67, 199[.]19[.]95[.]68 (first seen 2026-11-02)
- ARTEX servers: 91[.]92[.]240[.]238, 85[.]11[.]168[.]45 (first seen 2026-11-04), 31[.]77[.]229[.]35 (2026-10-28), 178[.]16[.]54[.]129 (2026-10-19)
- C2 server: 85[.]11[.]167[.]52 (first seen 2026-11-04)
Microsoft listed all of these as active as of 2026-11-06. Its Sentinel hunting query gives one ARTEX address as 178[.]15[.]54[.]129 rather than the 178[.]16[.]54[.]129 in its indicator table, so defenders may want to search for both. As with any IP list, the operators can rotate infrastructure quickly.
The larger point is that agentic tooling is no longer confined to a handful of well-resourced operators; a profit-driven crew is now running it against banks. When the attacker never tires and never slows down, the defender's best move may be to give it something fake to chew on.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.