ARTEX abuse expands as cybercriminals target financial sector
Storm-3358 uses agentic AI framework ARTEX to target financial sector organizations.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The financially motivated threat actor Storm-3358, a Cambodia-based group, has been targeting financial organizations globally since October 2026 using the agentic AI offensive framework ARTEX. They combine ARTEX with traditional tools to scan, exploit vulnerabilities, and deploy RATs like WISP, vshell, and AdaptixC2 for persistence and lateral movement. The use of AI frameworks accelerates attack stages, prompting defenders to leverage AI for detection and response.
The lesson from this incident
Full lessonStorm-3358, a financially motivated Cambodia-based group, has weaponized the agentic AI offensive framework ARTEX to dramatically accelerate every phase of their attacks against global financial institutions — from scanning to exploitation to persistent access via RATs like WISP, vshell, and AdaptixC2. The use of AI frameworks compresses attack timelines, leaving defenders with far less time to detect and respond before lateral movement occurs. Traditional detection tooling tuned to human-paced attack patterns struggles to keep up with AI-driven adversaries who can iterate and adapt in near real-time. This incident underscores that the financial sector must urgently modernize detection and response capabilities to match the velocity of AI-augmented threats.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
Indicators of Compromise
- malware — WISP
- malware — vshell
- malware — AdaptixC2