Search — “AdaptixC2”

Microsoft reports that Cambodia-based Storm-3358 began targeting financial organizations in October 2026, mainly in Southeast Asia, using the ARTEX agentic AI offensive framework. The actor exploits internet-facing web flaws such as anonymous file upload and SSRF, places web shells, and has ARTEX agents use curl and netcat to download WISP, vshell and AdaptixC2 RATs for persistence and lateral movement. Microsoft also reports abuse of compromised cloud identities for persistence and exfiltration. Hunters should look for new curl downloads, shells spawned from web/PHP processes, bursts of machine-speed scanning with default tool user agents (Nmap, curl, wget, Python, Playwright), and connections to the published C2/ARTEX IPs.

Group-IB and NyxLab attribute a large campaign to the actor k0t, who reportedly scans for exposed Fortinet FortiGate and Palo Alto GlobalProtect devices, exploits CVE-2025-64446 and CVE-2026-0257 or brute-forces credentials, and establishes an OpenConnect VPN foothold. Sources describe persistence via MeshCentral, Atera, Teramind, AnyDesk-like tools and AdaptixC2, Rclone exfiltration to Wasabi and MEGA, and AD enumeration with Impacket and Mimikatz. Hunters should look for OpenConnect sessions from edge devices, unexpected RMM agents, and Rclone or AdaptixC2 activity; the sources say more than 70,000 credentials were identified, and the actor is assessed as a possible access broker for Qilin and The Gentlemen.