Threat video1:00
Storm-3358 ARTEX Abuse Targets Finance: Detection & IOCs
Storm-3358 uses ARTEX against Southeast Asian finance targets via web shells and RATs. 9 detection rules, 17 IOCs and a free Splunk SPL rule.
Read the full threat intel for Storm-3358 ARTEX Abuse Targets Finance: Detection & IOCs →
Chapters
- 0:00The hookEight ARTEX agents active against banks.
- 0:04The storyIn October, Storm-3358 abused ARTEX to hit Southeast Asian banks.
- 0:12Attack pathReports show ARTEX exploited vulnerabilities.
- 0:26AttributionAttributed to Storm-3358.
- 0:32Indicators of compromise8 indicators to hunt: 8 IPs.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from reconnaissance to collection.
- 0:43Remediation4 steps now: Block and hunt for the eight listed IPs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Eight ARTEX agents active against banks.
0:05In October, Storm-3358 abused ARTEX to hit Southeast Asian banks.
0:12Reports show ARTEX exploited vulnerabilities.
0:15Deployed web shells for persistence.
0:18Then pulled WISP, vshell RAT malware.
0:21Persisted with cron, dumped financial data.
0:26Attributed to Storm-3358. Confidence: medium.
0:338 indicators to hunt: 8 IPs.
0:3816 ATT&CK techniques, from reconnaissance to collection.
0:434 steps now: Block and hunt for the eight listed IPs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.