ARTEX: cybercriminals from Cambodia turn the AI-driven attack tool on the financial sector

The Microsoft Threat Intelligence team warns that ARTEX, an attack tool driven by artificial intelligence, is now also being used by cybercriminals targeting the financial sector. In a new analysis published on Friday, November 6, 2026, Microsoft says that since October the threat actor Storm-3358 has been using the ARTEX framework against financial organisations.

Storm-3358 is a Cambodia-based, financially motivated threat actor. It mainly targets financial organisations in Southeast Asia, while also attacking a smaller number of large financial organisations elsewhere in the world.

For those unfamiliar with the tool: ARTEX is an open-source penetration-testing framework, that is, one that simulates attacks to test the security of a system. It consists of many AI agents written in the Go language, which can carry out a full attack, from reconnaissance of the target to exfiltration of data, with almost no human intervention. Microsoft had linked it on October 21 to Storm-0940, a group it considers aligned with the Chinese state, which used it against hundreds of organisations, including in the ConnectWise supply-chain attack. In several cases, the time from selecting a target to obtaining privileged access to cloud infrastructure was under three hours.

How Storm-3358 uses it

In Storm-3358’s attacks, Microsoft observed ARTEX being combined with conventional automated tools. The attackers scan internet-facing systems and exploit security gaps such as anonymous file upload and server-side request forgery (SSRF). They then install open-source remote access trojans (RATs), malicious programs that give the attacker control of the machine. The group has used WISP, vshell and AdaptixC2 to maintain access and move laterally within the network, while ARTEX agents downloaded them onto compromised systems with the netcat and curl tools.

In recent attacks with ARTEX, the perpetrators exploited vulnerabilities in web applications, used web shells (malicious scripts for persistent access to servers), harvested credentials from public sources and from compromised systems, and used compromised cloud identities to keep access and steal data. The agents can also try passwords with brute-force attacks or with common passwords across many accounts (password spraying), locate and abuse application programming interfaces (APIs), and copy entire databases. For the wider picture, Microsoft also points to its analysis of exposed secrets, which we covered in our report on AI agents scanning GitHub.

How to recognise it and what to do

How is such an attack recognised? Microsoft explains that the agents send many different requests within a short time and try variations of the same technique or move to the next stage at machine speed. ARTEX by default uses tools such as Nmap, curl, wget, Python HTTP clients, the WebFetch of the Norma SDK and headless Chromium via Playwright, whose traffic has characteristic features, such as default user-agent strings. Blocking this traffic does not stop an attack, since the agent quickly changes its characteristics, but detecting it can alert defenders.

The company also suggests defensive traps: honeypots, that is, tempting but useless targets, tarpits that consume the agent’s time and budget, and “fake successes” that convince it it has reached its goal, so that it stops. In Microsoft’s tests these mechanisms reduced the offensive traffic reaching real systems. The analysis also gives eight indicative IP addresses, among them three command-and-control (C2) nodes of WISP, all active on November 6.

Microsoft’s conclusion is that attackers are accelerating every stage of the attack with AI-based penetration frameworks, and that defenders must use equivalent tools to investigate and respond across large environments. For the broader threat landscape, see also Microsoft’s report on phishing in the third quarter.