Microsoft has linked a financially motivated intrusion cluster to ARTEX-assisted attacks on financial organizations. Its November 6 report identifies the actor as Storm-3358 and says the campaign began in October, primarily targeting Southeast Asia alongside a smaller number of large financial organizations elsewhere.
According to Microsoft Threat Intelligence, the Cambodia-based cluster combines the agentic offensive framework with conventional automated tools. Observed activity includes scanning internet-facing systems, exploiting anonymous file upload and server-side request forgery weaknesses, and deploying the WISP, vshell and AdaptixC2 remote access tools.
Microsoft says these tools supported persistence and lateral movement. The report does not name affected organizations or quantify losses. It describes observed activity attributed to a tracked cluster, rather than establishing that every capability available in ARTEX was used against every target.
The campaign is distinct from the exposed operator records and certificate-theft and cryptocurrency operations described in DaySec’s previous ARTEX coverage, which was based on Check Point Research.
Follow the activity across the investigation
Microsoft publishes sample infrastructure indicators and hunting logic for newly encountered curl download destinations. Such results need investigation: curl has legitimate uses, and the report cautions that related alerts may fire on other activity. An indicator match alone should not settle attribution.
For teams using Defender, Microsoft’s alert-review documentation explains how to inspect the connected entities and affected devices or users around an alert. It also distinguishes an action prevented before execution, suspicious behavior executed and then blocked, and a detection that may represent an ongoing attack. Those statuses help establish what response already occurred and what remains to investigate.
Microsoft’s advanced-hunting documentation describes access to up to 30 days of raw Defender XDR data; Sentinel data depends on configured retention. Query access requires appropriate permissions, with endpoint visibility governed by Defender for Endpoint access settings. Teams should check those boundaries when interpreting a search that returns no results.
For a financial institution assessing this report, build a timeline from the exposed application to suspicious downloads and subsequent remote access. Record the affected host, process chain and response actions, and keep gaps in available telemetry visible in the investigation notes.
