AI-Driven Attack Tool ARTEX Is Being Used Against Financial Organisations

Microsoft Threat Intelligence says a Cambodia-based group it tracks as Storm-3358 began targeting financial sector organisations in October 2026 using ARTEX, an agentic AI offensive framework. The group mainly targets financial organisations in Southeast Asia, along with a smaller number of large financial organisations globally.

Microsoft has seen the group combine ARTEX with conventional automated tools to scan internet-facing systems and exploit flaws such as anonymous file upload and server-side request forgery (SSRF). The attackers then install open-source remote access trojans, including WISP, vshell and AdaptixC2, to stay in place and move through networks. ARTEX agents have used utilities such as netcat and curl to download these tools. Related attacks have also involved web shells on compromised web servers, credentials taken from public sources and compromised systems, and stolen cloud identities used for persistence and data theft. ARTEX agents can also run brute-force and password spraying attacks, abuse APIs and dump databases.

Microsoft notes that agentic tools can use stolen credentials and compromised systems at machine speed to move sideways, gain higher privileges and steal data. This fits a wider trend of attackers using AI penetration testing frameworks to speed up every stage of an attack. Microsoft says defenders will need to use AI to investigate and respond across large environments, and it has published indicators of compromise to help detect related activity.