Microsoft Threat Intelligence said on 6 November that Storm-3358, a Cambodia-based group, began using the AI attack framework ARTEX in October 2026. Its targets are financial firms, mostly in Southeast Asia, plus a smaller number of large ones worldwide. ARTEX runs software agents that carry out attacks themselves.
Microsoft said the agents steer ordinary tools such as Nmap, curl and netcat. They probe exposed systems for weak spots, like anonymous file upload, which lets strangers put files on a server, and server-side request forgery, which tricks a server into sending requests for the attacker. Then they install open-source remote access tools: WISP, vshell and AdaptixC2. Microsoft did not say how many firms were hit, which ones, or whether data was stolen.
Microsoft says the agents retry variations at machine speed and quickly change default user agent strings, so blocking by address or user agent buys little. Buyers can ask three things. Do our detections key on behaviour, not addresses? Do we know every internet-facing upload and request path? Do we run decoys? Microsoft says decoys and tarpits, which waste an agent's time, cut attack traffic reaching real assets in its tests.