ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector

Key facts for Storm-3358 ARTEX abuse

Detection coverage for Storm-3358 ARTEX abuse

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5478 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX / Storm-3358 Web Exploitation - SSRF, Upload-Directory PHP Execution or Known ARTEX Client IP

Flags web requests that match the ARTEX (Storm-3358) exploitation chain from Microsoft's 2026-11-06 report: SSRF parameters pointing at loopback or cloud metadata endpoints, GET requests that execute PHP files dropped into upload/media/tmp directories after an anonymous file upload (web shell access), and any request from the eight published ARTEX/WISP C2 IPs (199.19.95.66-68, 91.92.240.238, 85.11.168.45, 85.11.167.52, 178.16.54.129, 31.77.229.35). Covers CWE-434 and CWE-918 abuse by an autonomous AI agent, where tool signatures change quickly but the exploited behaviour does not.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003
• Data sources: web:access_combined, iis:W3CIISLog, webserver_logs
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h
| eval uri_l=lower(uri)
```SSRF: URL-style parameter pointing at loopback or cloud metadata```
| eval ssrf_hit=if(match(uri_l,"(url|uri|src|dest|fetch|callback|webhook|redirect)=(https?(%3a|:)(%2f|/){2})?(169[.]254[.]169[.]254|127[.]0[.]0[.]1|localhost|metadata[.]google[.]internal)"),1,0)
```Web shell: GET of a PHP file inside an upload-style directory```
| eval shell_hit=if(method="GET" AND match(uri_l,"/(uploads?|files|media|tmp|images|attachments)/[^?]*[.](php[0-9]?|phtml|phar)([?]|$)"),1,0)
| eval upload_hit=if((method="POST" OR method="PUT") AND match(uri_l,"(upload|attach|import|media)") AND NOT (status>=400),1,0)
```Published ARTEX / WISP C2 infrastructure (Microsoft 2026-11-06)```
| eval artex_ip=if(match(clientip,"^(199[.]19[.]95[.]6[6-8]|91[.]92[.]240[.]238|85[.]11[.]168[.]45|85[.]11[.]167[.]52|178[.]16[.]54[.]129|31[.]77[.]229[.]35)$"),1,0)
| where ssrf_hit=1 OR shell_hit=1 OR artex_ip=1
| stats count min(_time) as firstTime max(_time) as lastTime sum(ssrf_hit) as ssrf_hits sum(shell_hit) as shell_hits sum(upload_hit) as upload_hits max(artex_ip) as known_artex_ip values(uri) as sample_uris values(status) as statuses by clientip host
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

let ArtexIPs = dynamic(['199.19.95.66','199.19.95.67','199.19.95.68','91.92.240.238','85.11.168.45','85.11.167.52','178.16.54.129','31.77.229.35']);
W3CIISLog
| where TimeGenerated > ago(24h)
| extend UriL = tolower(strcat(csUriStem, '?', csUriQuery))
| extend SsrfHit = UriL matches regex @'(url|uri|src|dest|fetch|callback|webhook|redirect)=(https?(%3a|:)(%2f|/){2})?(169[.]254[.]169[.]254|127[.]0[.]0[.]1|localhost|metadata[.]google[.]internal)',
         ShellHit = csMethod == 'GET' and UriL matches regex @'/(uploads?|files|media|tmp|images|attachments)/[^?]*[.](php[0-9]?|phtml|phar)([?]|$)',
         ArtexIp = cIP in (ArtexIPs)
| where SsrfHit or ShellHit or ArtexIp
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SsrfHits=countif(SsrfHit), ShellHits=countif(ShellHit), KnownArtexIp=max(ArtexIp), SampleUris=make_set(csUriStem, 10), Statuses=make_set(scStatus, 10) by cIP, Computer
| order by LastSeen desc

Sigma

title: ARTEX Storm-3358 Web Exploitation - SSRF, Upload-Directory PHP Execution or Known ARTEX Client IP
id: 3c7e9a14-5b0d-4f62-8a1e-9d4c2b6f7e01
status: experimental
description: Detects web requests matching the ARTEX (Storm-3358) exploitation chain - SSRF parameters targeting loopback or cloud metadata, requests that execute PHP files in upload directories (web shell access after anonymous file upload), and requests from published ARTEX/WISP C2 IPs. TL-2026-5478.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection_ssrf:
        c-uri-query|contains:
            - '=http://169.254.169.254'
            - '=http%3a%2f%2f169.254.169.254'
            - '=http://127.0.0.1'
            - '=http://localhost'
            - '=http://metadata.google.internal'
    selection_shell:
        cs-method: 'GET'
        c-uri|contains:
            - '/uploads/'
            - '/upload/'
            - '/files/'
            - '/media/'
            - '/tmp/'
        c-uri|endswith:
            - '.php'
            - '.phtml'
            - '.phar'
    selection_ip:
        c-ip:
            - '199.19.95.66'
            - '199.19.95.67'
            - '199.19.95.68'
            - '91.92.240.238'
            - '85.11.168.45'
            - '85.11.167.52'
            - '178.16.54.129'
            - '31.77.229.35'
    condition: 1 of selection_*
falsepositives:
    - Legitimate CMS plugins that serve PHP from upload or media directories
    - Internal vulnerability scanners probing SSRF parameters
level: high

Known false positives:

• Legitimate CMS plugins or themes that execute PHP files stored under upload, media or tmp directories
• Authorized vulnerability scanners or red-team exercises that probe SSRF parameters against loopback or metadata endpoints

Tuning notes: Set the index and sourcetype to your web tier (access_combined, nginx or Apache logs; W3CIISLog for IIS). Allow-list known plugin paths and scanner source IPs. Alert at once on known_artex_ip=1 or shell_hits>0, and treat ssrf_hits alone as medium priority unless the response status is 200. Because ARTEX agents change user agents and tooling signatures quickly, do not add user-agent filters.

• 🔒 ARTEX / Storm-3358 Entra ID Password Spray and Sign-ins From Published ARTEX IPs · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 Cron Persistence and Download-Chmod-Delete Command Chains · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 RDP Logons From Published ARTEX IPs or Single-Account Fan-out · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 Web Server Process Drops PHP Web Shell in Upload Directory · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 Web Server Child Process Reading Credentials or Dumping Databases · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 Reverse Shell, Pipe-to-Shell Download or WISP/vshell/AdaptixC2 RAT Execution · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 Web Server Process Spawning Shell, Downloader, Netcat or Nmap · unlock with TL Creds
• 🔒 ARTEX / Storm-3358 Network Traffic To or From Published WISP C2 and ARTEX Server IPs · unlock with TL Creds

Indicators of compromise for Storm-3358 ARTEX abuse

As of 2026-11-07, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5478.

Sample indicators (3 of 17)

• IP address: 199.19.95[.]66
• IP address: 199.19.95[.]67
• IP address: 199.19.95[.]68

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How Storm-3358 ARTEX abuse works

ARTEX is an open-source, multi-agent LLM penetration-testing framework (reported by the Cloud Security Alliance as written in Go with a Next.js frontend, developer handle 'Autumn-27') that can drive an autonomous intrusion from reconnaissance through data exfiltration using any OpenAI-compatible model endpoint, recording assets and vulnerabilities in a graph. The developer reportedly withdrew the project and moved it closed-source after misuse became public in October 2026, but existing copies and modified versions remain in circulation. Prior ARTEX abuse was reported against South Korean banks (CrowdStrike, 2026-10-07), Japanese targets (GMO Cybersecurity), the Storm-0940 ConnectWise supply-chain compromise (Microsoft, 2026-10-21) and the China-nexus Vapor Panda campaign against 200+ organizations (reported 2026-11-02).

In its 2026-11-06 report, Microsoft describes Storm-3358, a Cambodia-based, financially motivated intrusion cluster that began using ARTEX in October 2026. Storm-3358 primarily targets financial organizations in Southeast Asia and some large global financial entities. ARTEX agents scan internet-facing systems, exploit anonymous file upload and server-side request forgery (SSRF) flaws, enumerate and abuse APIs, brute-force and password-spray accounts, and use credentials harvested from public sources or from vulnerable systems. Post-compromise, agents drop web shells, execute shell commands from PHP, use netcat, curl and wget to pull RATs onto hosts, and deploy the WISP, vshell and AdaptixC2 RATs. Microsoft also observed abuse of compromised cloud identities, database dumping, and Azure Resource Manager operations from suspicious IPs. Supporting tooling includes Nmap, Python HTTP clients and headless Chromium via Playwright.

Microsoft lists eight IP addresses: three WISP C2 nodes (199.19.95.66-68, first seen 2026-11-02), ARTEX servers and a C2 server first seen 2026-10-19 through 2026-11-04, all active as of 2026-11-06. No file hashes, domains or URLs were published. Microsoft notes that blocking tool signatures will not stop an AI agent, which can quickly change them, and recommends deception (honeypots, decoys, tarpits, fake credentials via Sentinel Deception), Conditional Access with risk-based MFA, Entra ID Protection 'Verified threat actor IP' detections, and Defender for Endpoint behavioral detections. CVE identifiers were not stated in the source, so none are listed. The severity rating is an analyst judgment, not a source-stated rating. BeaconBeagle lookups for the listed IPs returned HTTP 502 during this research and could not be completed.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021.001 Remote Desktop Protocol

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 File Deletion

Discovery

T1046 Network Service Discovery

Persistence

T1053.003 Cron; T1505.003 Web Shell

Execution

T1059.004 Unix Shell

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force; T1110.003 Password Spraying; T1552.001 Credentials In Files

defense-impairment

T1222.002 Linux and Mac Permissions

Reconnaissance

T1589.001 Credentials; T1595.002 Vulnerability Scanning

Remediation for Storm-3358 ARTEX abuse

Patches

• No CVEs stated in the source; remediate the anonymous file upload and SSRF flaws in affected internet-facing applications per vendor guidance

Immediate actions

• Block and hunt for the eight listed IPs (199.19.95.66-68, 91.92.240.238, 85.11.168.45, 85.11.167.52, 178.16.54.129, 31.77.229.35) in network, proxy and firewall logs
• Review internet-facing applications for anonymous file upload and SSRF exposure and inspect web roots for unexpected PHP web shells
• Hunt for curl, wget and netcat downloads of new files and for new cron jobs on web servers
• Review Microsoft Entra ID Protection 'Verified threat actor IP' risk detections and Azure Resource Manager operations from suspicious IPs

Workarounds

• Restrict anonymous upload endpoints and egress from web servers
• Do not rely on blocking Nmap, curl or Playwright user-agent signatures alone, as AI agents can change them quickly

Longer-term hardening

• Deploy deception controls (honeypots, decoys, tarpits, fake credentials such as Microsoft Sentinel Deception) to misdirect autonomous AI agents
• Enforce Conditional Access with sign-in and user risk triggers and MFA on high-risk detections
• Use AI-assisted triage to investigate and respond at machine speed across large environments
• Reduce exposed attack surface and enforce strong, unique credentials with spray and brute-force protections

Affected and fixed versions

• Various — Internet-facing web applications and APIs with anonymous file upload or SSRF flaws; cloud identities

Timeline of Storm-3358 ARTEX abuse

• 2026-10-07 CrowdStrike reports locked-ioc-14 abuse against South Korean financial institutions (at least 7 affected, 68,000+ exposed records), as summarized by the Cloud Security Alliance
• 2026-10-17 China-nexus Vapor Panda begins an ARTEX-driven campaign against 200+ organizations across 14 countries (reported 2026-11-02)
• 2026-10-19 locked-ioc-14 server locked-ioc-2 first seen; GMO Cybersecurity reports ARTEX-linked servers targeting Japanese companies
• 2026-10-21 Microsoft reports Storm-0940 using locked-ioc-14 for a supply-chain compromise via ConnectWise Cloud Backup OAuth identities
• 2026-10-28 locked-ioc-14 server locked-ioc-8 first seen; CSA publishes research note on CyberStrikeAI and locked-ioc-14
• 2026-11-02 locked-ioc-15 C2 nodes locked-ioc-3, locked-ioc-4 and locked-ioc-5 first seen
• 2026-11-04 locked-ioc-14 servers locked-ioc-1 and locked-ioc-6 and C2 server locked-ioc-7 first seen
• 2026-11-05 Microsoft publishes reporting on threat actors using agentic AI tooling to find and abuse exposed secrets
• 2026-11-06 Microsoft publishes report on locked-ioc-10 abuse of locked-ioc-14 against the financial sector; all eight listed IPs active as of this date

Sources cited for Storm-3358 ARTEX abuse

• ARTEX abuse expands as cybercriminals target financial sector Microsoft · Vendor report · 2026-11-06
• Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX labs.cloudsecurityalliance.org · Research · 2026-10-28
• CSA research note: CyberStrikeAI and ARTEX multi-agent offense (PDF) labs.cloudsecurityalliance.org · Research · 2026-10-28
• Chinese hackers use ARTEX AI in automated attacks against 200 orgs BleepingComputer · News · 2026-11-02
• Armed with AI, hackers target endpoint security blind spots, raising stakes for CISOs csoonline.com · News
• ARTEX AI hacking framework spreads to another China-linked group letsdatascience.com · News
• Google says threat actors abuse ARTEX agentic pentesting frameworks in intrusions letsdatascience.com · News
• Vapor Panda ARTEX AI cyberattack 140 targets decryptiondigest.com · News

More in threat intel

• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)
• Brute Force Attacks Against Internet-Exposed RDP/RD Gateway/RDWeb, SSH and macOS Logins (Huntress Brute Force Sentry)
• OpenAI GPT-6 Cyber AI Model Finds 81 Firefox Flaws and Develops Root Exploits for 948 Linux Kernel Flaws
• France Cyber Threat Outlook: Dark Web Credential Trade, Ransomware (Qilin/MedusaLocker/LockBit) and NoName057(16) Hacktivism
• Insider Threat: FBI Supervisory Special Agent Pleads Guilty to Stealing $2.4M in Crypto Seized from Nation-State Hackers and Crime Victims