Microsoft has named a Cambodia-based criminal group, Storm-3358, that since October has turned the ARTEX agentic AI framework on banks and other financial firms. The techniques are not new, but they now run at machine speed, so defenders have far less time to notice and react.
What happened
On 6 November 2026 Microsoft Threat Intelligence published research on Storm-3358, a financially motivated intrusion cluster it assesses to be based in Cambodia. According to Microsoft, the group began targeting the financial sector in October using ARTEX, the open-source autonomous penetration testing framework that has featured in a string of incidents this autumn. Most of its targets are financial organisations in South-East Asia. A smaller number are large financial institutions elsewhere in the world, and the report does not name countries outside that region.
Microsoft has not named any victims, given loss figures or put a number on intrusions. It did publish a set of network indicators. The earliest was first seen on 19 October and several first appeared between 2 and 4 November. Microsoft said all of them were still active when the post went out. Storm-3358 is separate from Storm-0940, the China-nexus actor Microsoft blamed for the ConnectWise supply chain compromise; the only link is the tool.
What is new here is a named, profit-driven crew using it in a sustained campaign against one sector.
The technical picture
Storm-3358 does not need a zero-day. Microsoft describes ARTEX agents working alongside conventional automated scanners to sweep internet-facing systems. They then exploit two familiar classes of web application weakness: file upload endpoints that accept files without authentication, and server-side request forgery (SSRF). Once inside, the agents use everyday utilities such as curl and netcat to pull down open-source remote access trojans. Microsoft names three: WISP, vshell and AdaptixC2. These give the operators persistence and a platform for lateral movement.
Microsoft also sets out the wider ARTEX playbook it has seen across recent attacks. It includes planting web shells on compromised web servers, harvesting credentials from public leaks and breached hosts, and abusing compromised cloud identities to keep access and move data out. ARTEX agents can also brute-force and spray passwords, enumerate and abuse APIs, and dump databases. The common thread is pace: Microsoft warns that agents can turn a stolen credential into privilege escalation and exfiltration at machine speed, although it does not say how much faster that is than a human operator.
The detection guidance is the useful part. By default ARTEX drives standard tooling, including Nmap, curl, wget, Python HTTP clients and headless Chromium through Playwright, and that tooling can leave tell-tale traits such as default user-agent strings. Microsoft is blunt that blocking those traits will not stop an agent, which can simply change them. What gives agents away is behaviour: short bursts of very varied requests, repeated small variations on one technique against the same target, and a jump from probing to follow-on actions within moments.
Independent coverage has spotted a mistake in Microsoft’s material. WindowsForum noted that the Sentinel hunting query lists one IP address with a different second octet from the one in the indicator table. WindowsForum also reported an undefined variable, which we could not find in the current post. Anyone pasting the query straight into a workspace should check it first.
Why it matters for UK organisations
Microsoft has not said that British banks are among the victims. But “large financial organisations globally” is exactly where UK clearing banks, insurers, payment firms and the bigger building societies sit, and this is the same tool that has already been used against South Korean financial institutions earlier this autumn. Once a criminal group has a working pipeline, adding new targets costs it very little.
The bigger lesson is about time. Many UK firms still accept a detection-to-response window measured in hours, with alerts reviewed in the morning and change control the following week. Against an agent that probes, exploits, installs a RAT and starts moving within minutes, that window lets the attacker finish. For FCA and PRA regulated firms, this goes straight to operational resilience: important business services sitting behind internet-facing applications need detection that reacts in minutes, not hours.
It also matters for the long tail. Smaller lenders, fintechs and suppliers that connect into banks often run bespoke portals with upload features and server-side integrations, exactly what Storm-3358 targets.
Expert view
When we test web applications for financial clients, unauthenticated upload handlers and SSRF still turn up far more often than they should. They sit in forgotten corners, such as a broker portal’s document upload or a PDF generator that fetches remote images. What ARTEX changes is the economics. A human operator might spend a day enumerating one estate. An agent can do it across hundreds of targets in parallel, for the cost of some model tokens, and keep trying variations until something works.
I am also cautiously positive about Microsoft’s emphasis on deception. Honeypots, tarpits and what it calls “fake wins” exploit a real weakness in autonomous agents: they chase whatever looks like progress and can be persuaded that the job is done. Microsoft reports that in its own testing they cut the volume of hostile traffic hitting genuine systems, but it has published no figures, so treat that as promising rather than proven. Deception has long been an underused control in UK estates, and agentic attackers may finally make it worth the effort.
The detection-by-behaviour advice is sound too, but it means looking at rates and sequences, not single events. In my experience most SIEM rules alert on one thing happening once, which is the wrong shape for this threat.
What to do now
- Find your upload and fetch features. List every internet-facing application with file upload or server-side URL fetching. Make sure uploads require authentication, are validated and are stored outside the web root, and that outbound requests are restricted to approved destinations. This maps to the Cyber Essentials secure configuration control.
- Hunt retrospectively. Load Microsoft’s indicators into your SIEM and EDR and search back to mid-October. Fix the Sentinel query before running it, and remember the IPs will change.
- Look for web shells and new cron jobs on public web servers, along with unexpected curl or netcat downloads by web service accounts.
- Alert on behaviour, not signatures. Build rules for high request diversity from a single source, rapid retries against one endpoint, and scanning followed quickly by exploitation attempts.
- Harden identity. Enforce MFA and risk-based conditional access, rotate any credentials exposed publicly, and restrict outbound traffic from servers (Cyber Essentials user access control and firewalls).
- Pilot deception. Put decoy endpoints and credentials in front of high-value applications and treat any interaction with them as a priority incident.
- Patch internet-facing software promptly under the Cyber Essentials 14-day rule, as agents will exploit known flaws at scale.
Bottom line
Storm-3358 is a reminder that agentic AI does not need new techniques to be dangerous. Ordinary web flaws and open-source RATs become a serious threat when an agent chains them together faster than any human could. UK financial firms should close the boring gaps, tune detection for speed and behaviour, and consider giving these agents something fake to chase.
Sources
- Microsoft Security Blog: ARTEX abuse expands as cybercriminals target financial sector
- WindowsForum: Microsoft: Storm-3358 targets banks with ARTEX AI agents; Sentinel query needs fixes
- HuggingNews: Cambodian cybercriminals use AI agent ARTEX to target financial firms
- Security Affairs: Inside ARTEX: AI hacking tools, exposed servers and South Korean bank breaches
