Microsoft says a financially motivated threat group began using the agentic AI framework ARTEX to target financial organizations in October 2026. The group, which Microsoft tracks as Storm-3358, primarily targets organizations in Southeast Asia and has also targeted a smaller number of large financial organizations elsewhere.
According to Microsoft, Storm-3358 combined ARTEX with conventional automated tools to scan systems exposed to the internet. It exploited flaws including anonymous file upload and server-side request forgery, then installed open-source remote access trojans. Microsoft observed the group using WISP, vshell and AdaptixC2 to maintain access and move through compromised systems.
Microsoft says it observed ARTEX agents using tools such as netcat and curl to download those trojans. In other recent ARTEX-related attacks, threat actors used agents to exploit web applications, maintain access through web shells, obtain credentials and use compromised cloud identities to extract data.
Defenders can recognize scanning by agentic AI tools
The company says rapid bursts of varied requests and quick retries can help defenders recognize scanning by agentic AI tools. ARTEX also uses common penetration testing tools that may leave recognizable network traffic, though Microsoft cautions that an agent can change those characteristics.
Microsoft says its tests of honeypots, decoys, tarpits and false signs of success reduced attack traffic reaching real assets and produced signals useful for investigation. It has also provided sample indicators of compromise to help defenders look for related activity. The company notes that attackers can change source IP addresses using proxies and virtual private networks.
Microsoft provides detections in its security products
Microsoft says related security detections and investigation tools are available across products including Entra ID Protection, Defender for Endpoint and the Defender portal. Customers’ available capabilities depend on their products and protections. Microsoft Defender XDR customers with a license for at least one Defender XDR product can access an ARTEX activity profile in the Defender portal.
