Actor Profile

Storm-3358 is a Cambodia-based, financially motivated intrusion cluster tracked by Microsoft Threat Intelligence. The actor primarily targets financial organizations in Southeast Asia, with additional operations against a smaller number of large financial institutions globally. Storm-3358 represents an emerging threat leveraging agentic AI offensive frameworks to accelerate traditional cybercrime operations against critical financial infrastructure.

TTPs (Tactics, Techniques, Procedures)

Storm-3358 employs the ARTEX agentic AI framework to automate reconnaissance and exploitation at machine speed. Initial access is achieved through scanning internet-facing systems for vulnerabilities including anonymous file upload and server-side request forgery (SSRF). The actor deploys open-source RATs (WISP, vshell, AdaptixC2) for persistence and lateral movement, delivered via utilities like netcat and curl. ARTEX agents perform web application vulnerability scanning and exploitation, web shell deployment for persistence, credential harvesting from public sources and compromised systems, brute-force and password spraying attacks, API enumeration and abuse, and database dumping. Compromised cloud identities are leveraged for persistence and data exfiltration. The agentic framework enables rapid lateral movement, privilege escalation, and data theft at machine speed across all attack chain stages.

Targets & Patterns

Storm-3358 focuses on organizations in the financial sector, with primary targeting concentrated in Southeast Asia and secondary operations against large financial institutions worldwide. The October 2026 campaign marks an expansion of ARTEX abuse by cybercriminals specifically against critical financial infrastructure. The targeting pattern suggests the actor seeks high-value financial data and systems, consistent with their financially motivated objectives. The geographic focus on Southeast Asia aligns with the actor's Cambodia-based operations, while global targeting of major financial organizations indicates capability and ambition beyond regional operations.

Historical Context

The October 2026 campaign represents Storm-3358's adoption of the ARTEX agentic AI offensive framework, marking an evolution in the actor's capabilities. This activity is part of a broader trend of threat actors accelerating attack chain stages with agentic AI penetration testing frameworks. Microsoft has documented this trend in related research including AI-driven, large-scale nation-state campaign using ARTEX and threat actor use of agentic AI tooling to find and abuse exposed secrets. The integration of ARTEX with conventional automated tools demonstrates Storm-3358's adaptation to emerging offensive technologies while maintaining established tradecraft.

Defensive Recommendations

  • Monitor for behavioral signatures of agentic AI activity: high-volume diverse requests in brief timeframes, rapid technique variation, and machine-speed progression between attack stages
  • Detect default tool signatures from ARTEX components including Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium/Playwright user agent strings and network patterns
  • Deploy defensive honeypots, decoys, tarpits, and fake wins (e.g., Microsoft Sentinel Deception) to divert autonomous AI attacks and generate high-confidence attribution signals
  • Configure Microsoft Entra ID Protection to trigger high-risk alerts on 'Verified threat actor IP' detections and enforce Conditional Access policies requiring MFA or blocking access from suspicious sign-ins
  • Implement endpoint monitoring for WISP, vshell, and AdaptixC2 RAT indicators, and hunt for suspicious use of netcat/curl for file downloads following web application exploitation or SSRF activity