Search — “Storm-3358”

Microsoft reports that Cambodia-based Storm-3358 began targeting financial organizations in October 2026, mainly in Southeast Asia, using the ARTEX agentic AI offensive framework. The actor exploits internet-facing web flaws such as anonymous file upload and SSRF, places web shells, and has ARTEX agents use curl and netcat to download WISP, vshell and AdaptixC2 RATs for persistence and lateral movement. Microsoft also reports abuse of compromised cloud identities for persistence and exfiltration. Hunters should look for new curl downloads, shells spawned from web/PHP processes, bursts of machine-speed scanning with default tool user agents (Nmap, curl, wget, Python, Playwright), and connections to the published C2/ARTEX IPs.