{"schema":"sanctity-signal/0.2","record_type":"signal","id":"microsoft-storm3358-artex-banks-e081","domain":"security","drop_id":"signal-e081","occurred_at":"2026-11-06","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Microsoft Threat Intelligence","action_type":"designation of Storm-3358 as a Cambodia-based criminal cluster using the agentic AI offensive framework ARTEX against financial organisations, with 8 published indicators and hunting queries","observed":"We read the primary ourselves: Microsoft's security blog post of November 6, 2026, ARTEX abuse expands as cybercriminals target financial sector, at microsoft.com. Microsoft says Storm-3358, which it describes as a Cambodia-based intrusion cluster, began targeting organisations in the financial sector using the agentic AI offensive framework ARTEX in October 2026. It primarily targets financial organisations in Southeast Asia, plus a smaller number of large financial organisations globally. On method: Storm-3358 uses ARTEX alongside conventional automated tools to scan systems connected to the public internet, exploits flaws including anonymous file upload and server-side request forgery, and installs the WISP, vshell and AdaptixC2 remote-access trojans for persistence and lateral movement, with ARTEX agents using netcat and curl to download them. On the framework: Microsoft says ARTEX by default drives Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright, and can run brute-force and password-spraying attacks, API enumeration and abuse, and database dumping. Microsoft's own words: this activity illustrates an ongoing trend of threat actors accelerating all stages of the attack chain. It says agentic tools of this kind can work through compromised credentials and systems at machine speed to move sideways. The post lists 8 indicator IP addresses, all marked active as of November 6: three WISP command and control nodes first seen November 2; three ARTEX or control servers first seen November 4; one ARTEX server first seen October 19, the earliest; and one first seen October 28. It ships a Defender XDR query on event ID 4688 comparing the last day against a 7 day baseline, and a Sentinel query over 30 days. One discrepancy we checked and are passing on: the indicator table gives 178.16.54.129 while the Sentinel query uses 178.15.54.129. Microsoft dates threat actor adoption of ARTEX to late August 2026 and the framework's release to July 2026. Not in the post: victim counts, losses, named organisations, or any claim about which model providers ARTEX reaches.","corrections":[],"evidence":{"status":"verified","note":null,"sources":[{"role":"primary","label":"Microsoft Security Blog: ARTEX abuse expands as cybercriminals target financial sector, Nov 6, 2026, read directly","url":"https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector"},{"role":"corrob","label":"Censys research blog on ARTEX exposure, Nov 5, 2026, reported at 1,465 hosts","url":"https://censys.com/blog/artex-agentic-asbestos/"},{"role":"corrob","label":"Cyber Security News: ARTEX AI hacking framework found on 1,465 public servers, Nov 6, 2026","url":"https://cybersecuritynews.com/artex-ai-hacking-framework"},{"role":"corrob","label":"WindowsForum summary of the Microsoft report, with indicator discrepancy noted, Nov 6, 2026","url":"https://windowsforum.com/news/microsoft-storm-3358-targets-banks-with-artex-ai-agents-sentinel-query-needs-fixes.451295/"}]},"strength":{"cost":"Medium","commitment":"High","reversibility":"Moderate","persistence":"Year","rationale":"Cost is medium. Publishing costs Microsoft research time and burns 8 indicators the attackers can rotate within days, but it is not a financial commitment. Commitment is high: a Storm designation is a durable identifier Microsoft carries forward across reports, and naming Cambodia and the financial sector is a public analytic claim it will be held to. Reversibility is moderate, because designations get merged, renamed or reattributed when better evidence arrives. Persistence is years: the indicators go stale quickly, but the finding that a public agentic framework became criminal infrastructure within 4 months is the part that will still matter, and it is the part a defender cannot patch."},"shift":{"prior":"AI attack frameworks are researchers' tools, loose on exposed servers.","action":"We read the primary ourselves: Microsoft's security blog post of November 6, 2026, ARTEX abuse expands as cybercriminals target financial sector, at microsoft.com. Microsoft says Storm-3358, which it describes as a Cambodia-based intrusion cluster, began targeting organisations in the financial sector using the agentic AI offensive framework ARTEX in October 2026. It primarily targets financial organisations in Southeast Asia, plus a smaller number of large financial organisations globally. On method: Storm-3358 uses ARTEX alongside conventional automated tools to scan systems connected to the public internet, exploits flaws including anonymous file upload and server-side request forgery, and installs the WISP, vshell and AdaptixC2 remote-access trojans for persistence and lateral movement, with ARTEX agents using netcat and curl to download them. On the framework: Microsoft says ARTEX by default drives Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright, and can run brute-force and password-spraying attacks, API enumeration and abuse, and database dumping. Microsoft's own words: this activity illustrates an ongoing trend of threat actors accelerating all stages of the attack chain. It says agentic tools of this kind can work through compromised credentials and systems at machine speed to move sideways. The post lists 8 indicator IP addresses, all marked active as of November 6: three WISP command and control nodes first seen November 2; three ARTEX or control servers first seen November 4; one ARTEX server first seen October 19, the earliest; and one first seen October 28. It ships a Defender XDR query on event ID 4688 comparing the last day against a 7 day baseline, and a Sentinel query over 30 days. One discrepancy we checked and are passing on: the indicator table gives 178.16.54.129 while the Sentinel query uses 178.15.54.129. Microsoft dates threat actor adoption of ARTEX to late August 2026 and the framework's release to July 2026. Not in the post: victim counts, losses, named organisations, or any claim about which model providers ARTEX reaches.","update":"A financially motivated crew runs one as its working toolchain."},"inference":{"established":["Microsoft designated Storm-3358 and published 8 indicator IP addresses.","The group installs WISP, vshell and AdaptixC2 remote-access tools for persistence.","Targets are financial firms in Southeast Asia, plus some large global ones."],"unknown":["How many firms were breached, or what was taken. Microsoft gives no count.","That a state directs it. Microsoft calls the cluster financially motivated.","Which commercial AI models ARTEX calls, if any."]},"narrative":{"hook":"Microsoft named a Cambodia-based criminal group running the ARTEX AI hacking framework against banks.","plain":"Microsoft calls the group Storm-3358 and says it began in October 2026, using AI agents to scan, exploit and install remote-access malware. Caveat: Microsoft published no count of victims.","story":["ARTEX was published in July as a penetration-testing framework. Four months later a vendor with global telemetry says a criminal cluster has made it the front end of an attack chain on financial firms. The gap between a dual-use release and its industrial misuse is now measured in months, not years."],"trail":[{"d":"JUL 2026","t":"ARTEX is released publicly as an agentic offensive security framework, driving Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch and headless Chromium through Playwright by default."},{"d":"LATE AUG","t":"Microsoft dates the start of threat actor adoption of ARTEX to late August 2026."},{"d":"OCT 19","t":"The earliest indicator in Microsoft's table is first seen: 178.16.54.129, an ARTEX server. A second follows on October 28. Microsoft dates the financial sector campaign to October."},{"d":"NOV 5","t":"Censys reports ARTEX exposed on 1,465 internet-facing hosts, 155 of them carrying other threat detections, with 32 open directories. Edition 078 cards a different ARTEX story: a researcher's agent escaping its test environment and taking a company's customer records."},{"d":"NOV 6","t":"Microsoft publishes the Storm-3358 report with 8 indicators and hunting queries, hours before Chainalysis begins restoring the products it took offline after its own agentic intrusion. Editions 079 and 080 reached neither."},{"d":"Reacts","r":true,"t":"Financial regulators in Southeast Asia and the banks they supervise; Microsoft's own Defender and Sentinel customers, who now have queries to run; ARTEX's maintainers and the dual-use release decision; the other vendors Microsoft cites on ARTEX, CrowdStrike, Censys and Google; and every laboratory shipping a cyber-capable model into the same market."}],"glossary":[{"term":"ARTEX","def":"A publicly released framework that lets AI agents run the steps of a penetration test, choosing their own next move rather than following a fixed script."},{"term":"Storm designation","def":"Microsoft's label for an intrusion cluster it can track but has not yet attributed to a known group or government."},{"term":"Remote-access trojan","def":"Malware that leaves an intruder a lasting door into a machine after the break-in, so they can return and move sideways."},{"term":"Server-side request forgery","def":"A flaw that tricks a server into fetching a web address the attacker chooses, often reaching systems behind the firewall."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"Agentic attack tools went mainstream","text":"July release, August adoption, October bank campaign. That is 4 months.","abstain":false},{"id":"b","label":"One regional crew, one sector","text":"Southeast Asian finance, one Cambodia-based cluster. The scope stays narrow.","abstain":false},{"id":"c","label":"Microsoft is marketing its defences","text":"The post ships Defender and Sentinel queries. It sells what it warns about.","abstain":false},{"id":"d","label":"Normal criminal tool adoption","text":"Crews always take up the newest public tooling. Only the label is new.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second vendor or a national computer emergency team attributes a named campaign against a different sector to an agentic framework, with published indicators, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"},{"linked_interpretation":"b","direction":"strengthens","observable_event":"No ARTEX campaign outside Southeast Asian finance is publicly attributed, and Microsoft publishes no further Storm-3358 report, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"},{"linked_interpretation":"d","direction":"strengthens","observable_event":"A bank or regulator discloses a loss from this campaign and attributes the breach to the conventional flaws rather than to the agent, by March 31, 2027.","window_end":"2027-03-31","state":"unresolved"}]}