November 7, 2026
- Microsoft Threat Intelligence attributes October's ARTEX-driven financial-sector attacks to Storm-3358, a Cambodia-based, financially motivated cluster hitting banks in Southeast Asia plus a smaller number of large global firms. ARTEX agents scan internet-facing systems, exploit anonymous file upload and SSRF, then pull WISP, vshell and AdaptixC2 down with netcat and curl; follow-on activity includes web shells, credential harvesting, abuse of compromised cloud identities for persistence and exfiltration, password spraying, API enumeration and database dumping. IOCs are published in the write-up (Microsoft) (earlier coverage). · Agentic Tooling in the Wild