# ARTEX agentic AI offensive framework abuse expands as Storm-3358 targets financial sector

> Microsoft reports expanded abuse of ARTEX, an agentic AI offensive framework, by cybercriminals targeting financial organizations. Storm-3358, a Cambodia-based intrusion cluster active since October 2026, primarily targets Southeast Asian financial organizations using vulnerability exploitation (anonymous file upload, SSRF), web shells, credential abuse, and RATs (WISP, vshell, AdaptixC2).

- **Published:** 2026-11-07T03:57:20Z
- **Last reviewed:** 2026-11-07T03:57:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5478
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5478.png
- **ID:** TL-2026-5478
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Storm-3358
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

ARTEX is an open-source, multi-agent LLM penetration-testing framework (reported by the Cloud Security Alliance as written in Go with a Next.js frontend, developer handle 'Autumn-27') that can drive an autonomous intrusion from reconnaissance through data exfiltration using any OpenAI-compatible model endpoint, recording assets and vulnerabilities in a graph. The developer reportedly withdrew the project and moved it closed-source after misuse became public in October 2026, but existing copies and modified versions remain in circulation. Prior ARTEX abuse was reported against South Korean banks (CrowdStrike, 2026-10-07), Japanese targets (GMO Cybersecurity), the Storm-0940 ConnectWise supply-chain compromise (Microsoft, 2026-10-21) and the China-nexus Vapor Panda campaign against 200+ organizations (reported 2026-11-02).

In its 2026-11-06 report, Microsoft describes Storm-3358, a Cambodia-based, financially motivated intrusion cluster that began using ARTEX in October 2026. Storm-3358 primarily targets financial organizations in Southeast Asia and some large global financial entities. ARTEX agents scan internet-facing systems, exploit anonymous file upload and server-side request forgery (SSRF) flaws, enumerate and abuse APIs, brute-force and password-spray accounts, and use credentials harvested from public sources or from vulnerable systems. Post-compromise, agents drop web shells, execute shell commands from PHP, use netcat, curl and wget to pull RATs onto hosts, and deploy the WISP, vshell and AdaptixC2 RATs. Microsoft also observed abuse of compromised cloud identities, database dumping, and Azure Resource Manager operations from suspicious IPs. Supporting tooling includes Nmap, Python HTTP clients and headless Chromium via Playwright.

Microsoft lists eight IP addresses: three WISP C2 nodes (199.19.95.66-68, first seen 2026-11-02), ARTEX servers and a C2 server first seen 2026-10-19 through 2026-11-04, all active as of 2026-11-06. No file hashes, domains or URLs were published. Microsoft notes that blocking tool signatures will not stop an AI agent, which can quickly change them, and recommends deception (honeypots, decoys, tarpits, fake credentials via Sentinel Deception), Conditional Access with risk-based MFA, Entra ID Protection 'Verified threat actor IP' detections, and Defender for Endpoint behavioral detections. CVE identifiers were not stated in the source, so none are listed. The severity rating is an analyst judgment, not a source-stated rating. BeaconBeagle lookups for the listed IPs returned HTTP 502 during this research and could not be completed.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1589.001 Credentials
- T1190 Exploit Public-Facing Application
- T1078.004 Cloud Accounts
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1053.003 Cron
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1222.002 Linux and Mac Permissions
- T1110 Brute Force
- T1110.003 Password Spraying
- T1552.001 Credentials In Files
- T1046 Network Service Discovery
- T1021.001 Remote Desktop Protocol
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ARTEX / Storm-3358 Web Exploitation - SSRF, Upload-Directory PHP Execution or Known ARTEX Client IP** (`TL-2026-5478-SPL-001`)

Flags web requests that match the ARTEX (Storm-3358) exploitation chain from Microsoft's 2026-11-06 report: SSRF parameters pointing at loopback or cloud metadata endpoints, GET requests that execute PHP files dropped into upload/media/tmp directories after an anonymous file upload (web shell access), and any request from the eight published ARTEX/WISP C2 IPs (199.19.95.66-68, 91.92.240.238, 85.11.168.45, 85.11.167.52, 178.16.54.129, 31.77.229.35). Covers CWE-434 and CWE-918 abuse by an autonomous AI agent, where tool signatures change quickly but the exploited behaviour does not.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003
- **Data sources:** web:access_combined, iis:W3CIISLog, webserver_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=web sourcetype=access_combined earliest=-24h
| eval uri_l=lower(uri)
```SSRF: URL-style parameter pointing at loopback or cloud metadata```
| eval ssrf_hit=if(match(uri_l,"(url|uri|src|dest|fetch|callback|webhook|redirect)=(https?(%3a|:)(%2f|/){2})?(169[.]254[.]169[.]254|127[.]0[.]0[.]1|localhost|metadata[.]google[.]internal)"),1,0)
```Web shell: GET of a PHP file inside an upload-style directory```
| eval shell_hit=if(method="GET" AND match(uri_l,"/(uploads?|files|media|tmp|images|attachments)/[^?]*[.](php[0-9]?|phtml|phar)([?]|$)"),1,0)
| eval upload_hit=if((method="POST" OR method="PUT") AND match(uri_l,"(upload|attach|import|media)") AND NOT (status>=400),1,0)
```Published ARTEX / WISP C2 infrastructure (Microsoft 2026-11-06)```
| eval artex_ip=if(match(clientip,"^(199[.]19[.]95[.]6[6-8]|91[.]92[.]240[.]238|85[.]11[.]168[.]45|85[.]11[.]167[.]52|178[.]16[.]54[.]129|31[.]77[.]229[.]35)$"),1,0)
| where ssrf_hit=1 OR shell_hit=1 OR artex_ip=1
| stats count min(_time) as firstTime max(_time) as lastTime sum(ssrf_hit) as ssrf_hits sum(shell_hit) as shell_hits sum(upload_hit) as upload_hits max(artex_ip) as known_artex_ip values(uri) as sample_uris values(status) as statuses by clientip host
| convert ctime(firstTime) ctime(lastTime)
````

### Microsoft KQL

```kql
let ArtexIPs = dynamic(['199.19.95.66','199.19.95.67','199.19.95.68','91.92.240.238','85.11.168.45','85.11.167.52','178.16.54.129','31.77.229.35']);
W3CIISLog
| where TimeGenerated > ago(24h)
| extend UriL = tolower(strcat(csUriStem, '?', csUriQuery))
| extend SsrfHit = UriL matches regex @'(url|uri|src|dest|fetch|callback|webhook|redirect)=(https?(%3a|:)(%2f|/){2})?(169[.]254[.]169[.]254|127[.]0[.]0[.]1|localhost|metadata[.]google[.]internal)',
         ShellHit = csMethod == 'GET' and UriL matches regex @'/(uploads?|files|media|tmp|images|attachments)/[^?]*[.](php[0-9]?|phtml|phar)([?]|$)',
         ArtexIp = cIP in (ArtexIPs)
| where SsrfHit or ShellHit or ArtexIp
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SsrfHits=countif(SsrfHit), ShellHits=countif(ShellHit), KnownArtexIp=max(ArtexIp), SampleUris=make_set(csUriStem, 10), Statuses=make_set(scStatus, 10) by cIP, Computer
| order by LastSeen desc
```

### Sigma

```yaml
title: ARTEX Storm-3358 Web Exploitation - SSRF, Upload-Directory PHP Execution or Known ARTEX Client IP
id: 3c7e9a14-5b0d-4f62-8a1e-9d4c2b6f7e01
status: experimental
description: Detects web requests matching the ARTEX (Storm-3358) exploitation chain - SSRF parameters targeting loopback or cloud metadata, requests that execute PHP files in upload directories (web shell access after anonymous file upload), and requests from published ARTEX/WISP C2 IPs. TL-2026-5478.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection_ssrf:
        c-uri-query|contains:
            - '=http://169.254.169.254'
            - '=http%3a%2f%2f169.254.169.254'
            - '=http://127.0.0.1'
            - '=http://localhost'
            - '=http://metadata.google.internal'
    selection_shell:
        cs-method: 'GET'
        c-uri|contains:
            - '/uploads/'
            - '/upload/'
            - '/files/'
            - '/media/'
            - '/tmp/'
        c-uri|endswith:
            - '.php'
            - '.phtml'
            - '.phar'
    selection_ip:
        c-ip:
            - '199.19.95.66'
            - '199.19.95.67'
            - '199.19.95.68'
            - '91.92.240.238'
            - '85.11.168.45'
            - '85.11.167.52'
            - '178.16.54.129'
            - '31.77.229.35'
    condition: 1 of selection_*
falsepositives:
    - Legitimate CMS plugins that serve PHP from upload or media directories
    - Internal vulnerability scanners probing SSRF parameters
level: high
```

**Known false positives:**

- Legitimate CMS plugins or themes that execute PHP files stored under upload, media or tmp directories
- Authorized vulnerability scanners or red-team exercises that probe SSRF parameters against loopback or metadata endpoints

**Tuning notes:** Set the index and sourcetype to your web tier (access_combined, nginx or Apache logs; W3CIISLog for IIS). Allow-list known plugin paths and scanner source IPs. Alert at once on known_artex_ip=1 or shell_hits>0, and treat ssrf_hits alone as medium priority unless the response status is 200. Because ARTEX agents change user agents and tooling signatures quickly, do not add user-agent filters.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ARTEX / Storm-3358 Entra ID Password Spray and Sign-ins From Published ARTEX IPs (locked: unlock with TL Creds)
- ARTEX / Storm-3358 Cron Persistence and Download-Chmod-Delete Command Chains (locked: unlock with TL Creds)
- ARTEX / Storm-3358 RDP Logons From Published ARTEX IPs or Single-Account Fan-out (locked: unlock with TL Creds)
- ARTEX / Storm-3358 Web Server Process Drops PHP Web Shell in Upload Directory (locked: unlock with TL Creds)
- ARTEX / Storm-3358 Web Server Child Process Reading Credentials or Dumping Databases (locked: unlock with TL Creds)
- ARTEX / Storm-3358 Reverse Shell, Pipe-to-Shell Download or WISP/vshell/AdaptixC2 RAT Execution (locked: unlock with TL Creds)
- ARTEX / Storm-3358 Web Server Process Spawning Shell, Downloader, Netcat or Nmap (locked: unlock with TL Creds)
- ARTEX / Storm-3358 Network Traffic To or From Published WISP C2 and ARTEX Server IPs (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `199.19.95[.]66`
- IP address: `199.19.95[.]67`
- IP address: `199.19.95[.]68`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ARTEX abuse expands as cybercriminals target financial sector](https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/)
- [Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX](https://labs.cloudsecurityalliance.org/research/csa-research-note-cyberstrikeai-artex-multi-agent-offense-20/)
- [CSA research note: CyberStrikeAI and ARTEX multi-agent offense (PDF)](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/10/CSA_research_note_cyberstrikeai_artex_multi_agent_offense_20261028-csa-styled.pdf)
- [Chinese hackers use ARTEX AI in automated attacks against 200 orgs](https://bleepingcomputer.com/news/security/chinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs)
- [Armed with AI, hackers target endpoint security blind spots, raising stakes for CISOs](https://www.csoonline.com/article/4243816/armed-with-ai-hackers-target-endpoint-security-blind-spots-raising-stakes-for-cisos.html)
- [ARTEX AI hacking framework spreads to another China-linked group](https://letsdatascience.com/news/artex-ai-hacking-framework-spreads-to-another-china-linked-g-80a54aec)
- [Google says threat actors abuse ARTEX agentic pentesting frameworks in intrusions](https://letsdatascience.com/news/google-says-threat-actors-abuse-artex-agentic-pentesting-fra-871f1f6e)
- [Vapor Panda ARTEX AI cyberattack 140 targets](https://www.decryptiondigest.com/blog/vapor-panda-artex-ai-cyberattack-140-targets)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5478