Microsoft: a Cambodia-based crew is pointing ARTEX AI agents at banks and other financial firms

Microsoft Threat Intelligence said on November 6, 2026 that a financially motivated group it tracks as Storm-3358, which it describes as Cambodia-based, has been using the ARTEX agentic AI attack framework against financial organizations since October 2026, mainly in Southeast Asia but also some large firms globally. Financial-sector security teams should check Microsoft's published indicators, review high-risk sign-ins, and close basic web weaknesses such as anonymous file upload. Microsoft has not named victims or said what, if anything, was stolen.

What happened, in plain English

ARTEX is an "agentic" AI offensive framework: software in which AI agents decide on their own which step to take next, run hacking tools, read the results and keep going without a human typing each command. Over the past weeks several security companies have reported criminals using it; this site has covered Check Point's look inside exposed ARTEX servers, Microsoft's report on the ConnectWise supply-chain attack, AI agents hunting leaked cloud keys on GitHub and the WorkOS breach by a researcher's runaway ARTEX agent.

The new report adds a sector focus. Microsoft says Storm-3358 combines ARTEX with ordinary automated scanners to probe banks' and financial firms' internet-facing systems. The agents look for well-known weaknesses, such as upload forms that accept files from anyone, or server-side request forgery (SSRF), a flaw that tricks a web server into fetching internal addresses on the attacker's behalf. Once in, the group installs open-source remote access trojans (RATs: programs that give an attacker remote control of a machine) named WISP, vshell and AdaptixC2, then moves to other systems.

An analogy: a burglar who never sleeps and can try every door handle on the street in minutes. The doors are still the ordinary ones; what has changed is speed and persistence.

Microsoft does not say whether any specific Storm-3358 intrusion succeeded, names no victims and gives no figures for data stolen. It also does not explain how it concluded the group is based in Cambodia; that attribution is Microsoft's.

Are you affected? What to do now

Most relevant to: banks, payment and fintech companies, insurers, and their IT and managed-service providers, especially in Southeast Asia. Other organizations face the same techniques from other ARTEX users, so the defensive steps apply broadly.

Check exposure

• Search firewall, proxy and sign-in logs back to mid-October 2026 for the IP addresses Microsoft published (below). Treat hits as leads, not proof: Microsoft calls these "sample" indicators and notes that attackers rotate addresses through proxies and VPNs.
• Note a discrepancy in Microsoft's post, still present when we re-checked on November 9: the indicator table lists 178.16.54[.]129, while the Microsoft Sentinel hunting query in the same post lists 178.15.54.129. The table value is the one tied to an "ARTEX server, first seen 2026-10-19". Search for both, or correct the query before running it.
• If you use Microsoft Entra ID, review risky sign-ins: Microsoft says ARTEX-linked sign-ins raise "Verified threat actor IP" risk detections at high risk.
• Look for new, unexplained files downloaded with curl on servers, new cron jobs, and web shells on web servers (Microsoft lists these among the related Defender detections).

Indicators published by Microsoft (as of November 6, 2026)

• WISP command-and-control nodes: 199.19.95[.]66, 199.19.95[.]67, 199.19.95[.]68 (first seen November 2)
• ARTEX servers: 91.92.240[.]238 and 85.11.168[.]45 (first seen November 4), 178.16.54[.]129 (October 19), 31.77.229[.]35 (October 28)
• C2 server: 85.11.167[.]52 (first seen November 4)

Fix, in order

1. Close anonymous file-upload endpoints and patch or mitigate SSRF-prone applications on internet-facing systems.
2. Enforce Conditional Access (or your identity provider's equivalent) to require MFA or block high-risk sign-ins; stop password spraying with lockout and leaked-password checks.
3. Rotate credentials found in public places or on compromised hosts; review cloud identities that could be abused for persistence or data export.
4. Tune detection for agent-like behaviour: bursts of varied requests, rapid retries of the same technique, and unusually fast moves to the next stage. Default tool user agents (for example curl, Python HTTP clients, headless Chromium) are a useful alert, but Microsoft warns that blocking them "will not stop an attack by an AI agent".
5. Consider deception: honeypots, decoys and tarpits (systems built to waste an attacker's time).
6. Ask your managed-service providers and outsourced IT whether they have checked these indicators.

The expert view

Technically, little here is new. The entry points (anonymous upload, SSRF, sprayed passwords, exposed credentials) and the post-exploitation kit (open-source RATs, web shells, cron persistence) are standard. What Microsoft documents is the operating model: a regional criminal cluster outsourcing the reconnaissance-to-exploitation loop to an agent framework and running it "at machine speed". That fits the pattern of the past month, in which ARTEX use has been reported against Japanese firms, Korean banks, MSP supply chains and cloud secrets. The barrier to running broad, persistent campaigns keeps dropping; the skill needed to pick targets and monetise access does not.

The more interesting part is the defensive guidance. Agents are goal-seeking and budget-limited. They keep trying until something "works", and every step costs model calls and time. Microsoft leans into that: tarpits to burn the agent's time and budget, decoys to divert it, and "fake wins" that present convincing evidence the objective is complete so the agent stops on a false success. Microsoft says that in its testing these controls reduced attack traffic reaching real assets and produced high-confidence signal, but it published no test design or numbers. Deception is not new, but it has a better cost-benefit case against an automated adversary that cannot easily tell a decoy from a target.

Behavioural detection follows the same logic. Human operators are slow and selective; agents produce bursts of varied attempts and fast, systematic retries. That signature is easier to see in volume than any single indicator, and more durable than IP lists that rotate within days.

What is still unknown: who builds and distributes ARTEX and how Storm-3358 obtained it; how Microsoft attributes the cluster to Cambodia; how many organizations were targeted or breached; and whether any data or money was taken. Microsoft also says protections available to customers depend on the products deployed, so non-Microsoft shops will need to map the advice to their own tooling.

Official sources

• Microsoft Threat Intelligence — "ARTEX abuse expands as cybercriminals target financial sector" (November 6, 2026)
• Coverage: WindowsForum — notes on the Sentinel query errors (community site, not affiliated with Microsoft)