Microsoft: Storm-3358 Targets Banks With ARTEX AI Agents; Sentinel Query Needs Fixes

What Microsoft reported​

In October 2026, Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX. Microsoft describes the actor as a Cambodia-based intrusion cluster. It mainly targets financial organizations in Southeast Asia, plus a smaller number of large financial firms worldwide. Those attribution and geography claims are Microsoft's own assessments. The post doesn't name victims or explain how it reached them.

The activity goes beyond reconnaissance. Microsoft says the actor combined ARTEX with conventional automated tools to do the following:

• Scan internet-facing systems.
• Exploit flaws including anonymous file upload and server-side request forgery (SSRF).
• Install open-source remote access trojans (RATs). Storm-3358 used WISP, vshell, and AdaptixC2 for persistence and lateral movement.

ARTEX agents were seen using netcat and curl to pull those RATs onto compromised machines.

Microsoft also describes wider ARTEX-related behavior in recent attacks. That includes web shells for persistence on web servers, credentials taken from public sources and compromised systems, and compromised cloud identities used for persistence and data theft. ARTEX agents can also do brute-force and password-spray attacks, API enumeration and abuse, and database dumping. The post presents these as observed or possible capabilities across ARTEX-related attacks. It doesn't claim every technique appeared in every Storm-3358 intrusion.

What the report does not say​

• It names no specific vulnerable product, version, or CVE, so there is no patch to chase.
• It gives no victim count and no confirmed financial losses.
• It doesn't quantify how much faster the activity was than human-run operations.

The real risk here is speed, not a new kind of bug. Microsoft says agentic frameworks fire many varied requests in a short window, retry variations of a technique, and move to next-stage actions at machine speed. Given compromised credentials, they can move laterally, escalate privileges, and exfiltrate data quickly.

Why this keeps coming up: ARTEX in context​

ARTEX isn't new to the headlines. Censys describes it as an open-source, LLM-driven autonomous penetration testing framework released in July 2026. Several vendors have reported it in different campaigns:

• Censys notes that CrowdStrike linked it to a campaign against South Korean financial institutions, and Microsoft linked it to Storm-0940's compromise of ConnectWise customer tenants.
• Google's threat intelligence team says since late August 2026, ARTEX has been adopted by a diverse range of threat actors, from extortion crews to suspected espionage operators.

Storm-3358 is a separate actor from both of those. Microsoft's Storm-0940 report is a different campaign, with a China-state-aligned actor and a supply-chain angle. It shouldn't be blended into the Storm-3358 story. The shared thread is the tool. Different actors with different motives are using the same framework.

Detection: look at behavior, not just tools​

Microsoft says ARTEX by default uses Nmap, curl, wget, Python HTTP clients, Norma SDK WebFetch, and headless Chromium through Playwright. Their traffic can carry telltale traits such as default user-agent strings. Blocking those traits won't stop an AI agent, because it will change them quickly. Spotting them can still tip defenders off that something is probing them.

Behavioral signals matter more:

1. Bursts of widely varied requests in a short time.
2. Repeated variations of the same technique against one target.
3. Fast progression from probing to follow-on actions.

Nmap, curl, and wget all have legitimate uses. Treat their appearance as a lead to investigate, not proof of compromise.

Defensive deception​

Microsoft recommends honeypots and decoys, tarpits, and "fake wins":

• Honeypots and decoys (Microsoft names Microsoft Sentinel Deception as an example) give the agent attractive but worthless targets.
• Tarpits burn the agent's time and budget.
• Fake wins show convincing evidence that the objective is done, which can make the agent stop on a false success.

Microsoft says its testing found these controls reduced attack traffic reaching real assets and produced high-confidence, attribution-quality signal. The post gives no test design or numbers, so read that as Microsoft's claim, not a guaranteed result.

Microsoft product signals​

• Microsoft Entra ID Protection: Sign-ins from known threat-actor infrastructure, including ARTEX, generate "Verified threat actor IP" risk detections at high risk. Admins can use Conditional Access policies tied to sign-in or user risk to require multifactor authentication or block access.
• Microsoft Defender for Endpoint: Alerts can help investigate suspicious device activity. IOCs can support detection and, when configured, blocking.
• Microsoft Defender for Cloud: Named signals include publicly exposed storage containers and Azure Resource Manager operations from suspicious IPs.
• Defender coverage by tactic: The listed alerts span execution, collection, credential access, defense evasion, discovery, command and control, lateral movement, and persistence. Examples include suspicious shell execution from a PHP application, suspicious port scans, possible reverse shells, suspicious curl behavior, possible web server compromise, and suspicious cron job creation.
• Security Dashboard for AI: Microsoft says it aggregates security, identity, and data risk across Defender, Entra, and Purview.

Microsoft warns these alerts can fire on unrelated activity. It also says what a customer gets depends on the products and protections they've deployed. Several of these detections are Linux and web-server oriented, which fits the exploitation of internet-facing web apps.

Indicators of compromise​

Microsoft lists eight IP addresses, all reported active as of November 6, 2026:

Treat these as time-bounded leads, not a permanent blocklist. Microsoft notes that proxies and VPNs let attackers change source IPs and dodge static detections. Check your logs retroactively, at least back to mid-October for the earliest server.

Hunting queries: one caveat before you paste​

Microsoft supplies two queries:

• Defender XDR: It looks for new files downloaded with curl, using DeviceNetworkEvents plus Windows SecurityEvent process-creation events (event ID 4688). It compares the last day against a baseline from days 1 to 7 back. Curl is legitimate software, so review hosts and files before drawing conclusions.
• Sentinel: It checks the past 30 days of ASIM-supported network-session data against an IP list.

The Sentinel query as published has two problems:

1. Its IP list contains 178.15.54.129, while the IOC table says 178.16.54.129. Don't assume they're interchangeable. Correct it to match the table before running.
2. It references ioc_domains without defining it in the displayed snippet. Define it, even as an empty list, or remove the clause. Validate against your own schema.

The query uses curly quotes around one IP (85.11.167.52). If you copy and paste, those can break the query. Fix them to straight quotes.

What admins should do now​

1. Load the IPs into your SIEM and EDR for retroactive hunting, with the caveat above.
2. Fix and run the Sentinel query. Run the Defender XDR curl query and review any new remote file sources.
3. Inventory internet-facing web apps, especially upload endpoints and anything that can make server-side requests. Those are the flaw classes Microsoft names.
4. Hunt for web shells on public web servers and for unexpected cron jobs.
5. Review Entra ID Protection risk detections. Consider Conditional Access policies that demand MFA or block access at elevated sign-in risk.
6. Check cloud storage exposure and unusual Azure Resource Manager activity from unfamiliar IPs.
7. Consider decoys and tarpits for exposed surfaces, with realistic expectations. Microsoft's results are unquantified.

Takeaway​

Nothing in Storm-3358's reported toolkit is exotic: unauthenticated upload, SSRF, off-the-shelf RATs, and stolen credentials. ARTEX compresses the time between those steps. Fundamentals still matter most, including patching internet-facing apps, limiting credential exposure, and watching identity risk. Detection and response also have to work at a pace closer to the attacker's.