[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUyrp3-7p4Sr7rd2IwaSFmdbnoUyUOIDfnzNrEa0rZRs":3},{"article":4,"iocs":57,"watch_terms":65,"solutions":66,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":39},"72df602b-0d5e-4af5-8d25-f7646826ad61","ARTEX abuse expands as cybercriminals target financial sector","artex-abuse-expands-as-cybercriminals-target-financial-sector-631279","In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX. The post ARTEX abuse expands as cybercriminals target financial sector appeared first on Microsoft Security Blog.","The financially motivated threat actor Storm-3358, a Cambodia-based group, has been targeting financial organizations globally since October 2026 using the agentic AI offensive framework ARTEX. They combine ARTEX with traditional tools to scan, exploit vulnerabilities, and deploy RATs like WISP, vshell, and AdaptixC2 for persistence and lateral movement. The use of AI frameworks accelerates attack stages, prompting defenders to leverage AI for detection and response.","Storm-3358 uses agentic AI framework ARTEX to target financial sector organizations.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F06\u002Fartex-abuse-expands-as-cybercriminals-target-financial-sector\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FARTEX-finance-industry-featured.png","2026-11-07T02:44:34+00:00","2026-11-07T04:00:22.035074+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"Storm-3358","threat_actor",{"name":21,"type":22},"ARTEX","campaign",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":28},"Microsoft Defender","product",{"name":30,"type":28},"Microsoft Sentinel",{"name":32,"type":33},"AI","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":34,"icon":36,"name":37,"slug":38},null,"Threat Intelligence","threat-intelligence",[40,45,50,55],{"category":41},{"id":42,"icon":36,"name":43,"slug":44},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":46},{"id":47,"icon":36,"name":48,"slug":49},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":51},{"id":52,"icon":36,"name":53,"slug":54},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":56},{"id":34,"icon":36,"name":37,"slug":38},[58,61,63],{"type":54,"value":59,"context":60},"WISP","RAT used by Storm-3358 for persistence and lateral movement.",{"type":54,"value":62,"context":60},"vshell",{"type":54,"value":64,"context":60},"AdaptixC2",[24,27,30],{"controls":67,"vendors":154},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":98,"name":99,"problem":100,"products":101},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":49,"name":127,"problem":128,"products":129},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[155],{"slug":156,"name":24,"logo_path":157,"roles":158},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[159],"reported_by",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"ai-powered-threat-actor-storm-3358-targets-financial-sector-using-artex-framework","AI-Powered Threat Actor Storm-3358 Targets Financial Sector Using ARTEX Framework","Storm-3358, a financially motivated Cambodia-based group, has weaponized the agentic AI offensive framework ARTEX to dramatically accelerate every phase of their attacks against global financial institutions — from scanning to exploitation to persistent access via RATs like WISP, vshell, and AdaptixC2. The use of AI frameworks compresses attack timelines, leaving defenders with far less time to detect and respond before lateral movement occurs. Traditional detection tooling tuned to human-paced attack patterns struggles to keep up with AI-driven adversaries who can iterate and adapt in near real-time. This incident underscores that the financial sector must urgently modernize detection and response capabilities to match the velocity of AI-augmented threats.",[165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","DORA Article 9","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"DORA Article 9":173,"MITRE ATT&CK T1566: Phishing":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"CIS Control 17: Incident Response Management":176,"CIS Control 7: Continuous Vulnerability Management":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":179},"DORA Article 9 mandates that EU financial entities implement advanced ICT security controls and resilience testing, directly applicable to defending against AI-accelerated threat actors like Storm-3358 targeting the financial sector.","While ARTEX automates exploitation, initial access vectors for financially motivated actors often include phishing; mapping defenses to the full ATT&CK chain helps financial organizations anticipate and block each stage of Storm-3358's attack lifecycle.","SI-2 requires organizations to identify, report, and remediate flaws in information systems on a defined schedule, directly addressing the exploitable vulnerabilities that ARTEX's scanning stage depends on for initial access.","AI-driven attacks compress the time available to respond; a mature, pre-tested incident response plan specifically tuned to rapid-progression intrusions is essential to contain RAT deployments before they establish deep persistence.","Storm-3358 leverages ARTEX to rapidly scan and exploit known vulnerabilities; a mature continuous vulnerability management program with enforced patch SLAs would close exploitable gaps before automated tools can weaponize them.","This control requires timely identification and remediation of technical vulnerabilities, which is the primary attack surface ARTEX's automated scanning and exploitation capabilities are designed to systematically discover and abuse.","The deployment of RATs for persistence and lateral movement exploits weak identity controls; enforcing least-privilege access and strong authentication would limit how far adversaries can move post-compromise."]