Executive Summary
In October 2026, Microsoft Threat Intelligence identified Storm-3358, a Cambodia-based intrusion cluster, leveraging the agentic AI offensive framework ARTEX to target financial organizations in Southeast Asia and globally. The group combines AI-driven automation with conventional tools to conduct rapid scanning, server-side request forgery (SSRF) exploitation, and anonymous file uploads to gain initial access.
Technically, the actor utilizes ARTEX agents to automate complex tasks at machine speed, including API enumeration, brute-force attacks, and database dumping. For persistence and lateral movement, Storm-3358 deploys a suite of remote access trojans (RATs) such as WISP, vshell, and AdaptixC2. The use of agentic AI allows these attackers to retry variations of techniques quickly, bypassing traditional static detection mechanisms.
This campaign underscores a critical shift in the threat landscape where financially motivated actors use AI to accelerate the entire attack lifecycle. The ability to execute lateral movement and data exfiltration at machine speed necessitates a defensive shift toward AI-powered response, deception technologies like honeypots, and behavioral-based monitoring of common penetration testing utilities.