Evidence · DiggingBeagle record
Microsoft Threat Intelligence: ARTEX abuse in financial-sector intrusions
First-party report of Storm-3358 targeting financial organizations with ARTEX tool execution and conventional remote-access malware.
- Source role
- primary disclosure
Evidence record
First-party report of Storm-3358 targeting financial organizations with ARTEX tool execution and conventional remote-access malware.
Claim-level citations (2)
- supportsStorm-3358 deployed remote-access tools through ARTEX-assisted financial-sector intrusions: Microsoft reported that the actor it tracks as Storm-3358 used the ARTEX agentic offensive framework during an October 2026 campaign targeting financial-sector organizations in Southeast Asia and some global financial institutions.
Opening campaign summary: October 2026, Storm-3358 and financial-sector targets
- supportsStorm-3358 deployed remote-access tools through ARTEX-assisted financial-sector intrusions: Microsoft observed ARTEX agents use netcat and curl to obtain WISP, vshell and AdaptixC2 remote-access tools after exploitation involving anonymous file upload and server-side request forgery.
Campaign paragraph: exploitation, ARTEX agent download commands, WISP, vshell and AdaptixC2