ARTEX abuse expands as cybercriminals target financial sector
Source Microsoft Security Blog
Description
In October 2026, the financially motivated threat actor Storm-3358 began targeting financial organizations primarily in Southeast Asia and globally using the agentic AI offensive framework ARTEX. ARTEX automates scanning, exploitation of vulnerabilities such as anonymous file upload and SSRF, and deployment of open-source remote access trojans (RATs) for persistence and lateral movement. The framework also performs credential compromise, brute-force attacks, API abuse, and data exfiltration at machine speed. Microsoft recommends detection through behavioral signals, network traffic characteristics, and deploying defensive honeypots, decoys, tarpits, and fake wins to mitigate attacks. Microsoft security products integrate detections and investigative context to help defend against these AI-accelerated attacks.