Storm 3358 targets financial sector using ARTEX offensive framework
Microsoft has observed Cambodia based hacking cluster Storm 3358 using the ARTEX offensive framework to target global financial institutions.
FTMQ Security, written by our newsroom0 views
Microsoft reported on November 7, 2026, that the hacking group Storm-3358 began targeting financial sector organizations in October 2026. The group is using an agentic artificial intelligence offensive framework known as ARTEX to carry out the attacks. [1]
According to Microsoft, Storm-3358 is a financially motivated intrusion cluster based in Cambodia. The group primarily targets financial organizations located in Southeast Asia, along with a smaller selection of large financial entities globally. [1]
Microsoft observed the group combining ARTEX with conventional automated tools to scan systems connected to the public internet. Storm-3358 uses these tools to exploit security flaws, including server side request forgery and anonymous file upload vulnerabilities. [1]
As FTMQ Security reported earlier, ransomware attacks against the finance sector rose by 72 percent in the third quarter of 2026. The broader finance and technology sectors experienced the steepest increases in attacks during that period. [3]
In short
- Storm-3358 began using the ARTEX AI framework against financial targets in October 2026.
- Microsoft identifies Storm-3358 as a financially motivated intrusion cluster based in Cambodia.
- The hackers pair ARTEX with automated tools to exploit server-side request forgery and anonymous file uploads.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]ARTEX abuse expands as cybercriminals target financial sectorMicrosoft, 2d ago (the report this story comes from)
Background
- [2]Artex on Wikipedia
- [3]Ransomware Attacks Reach Record Volume in Third Quarter of 2026 FTMQ Security, 31d ago
Our newsroom writes these reports with the help of software, from the 3 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Hacker group TAG217 prepped South Korean bank attacks in AugustNation State Hacking, 22d ago
- China aligned group Storm 0940 uses AI tool in ConnectWise breachTop Stories, 18d ago
- ARTEX AI tool usage is far more widespread than reported, Censys findsData Breaches, 2d ago
- WorkOS reports data breach after attacker uses ARTEX AI toolTop Stories, 6d ago
- Active phishing campaign targets customers of 300 US banksThreat Intelligence, 3d ago
More in Threat Intelligence
- APT29 target unpatched mobile devices using patched exploit chains2d ago
- CISA adds SonicWall SSLVPN flaw to known exploited vulnerabilities catalog3d ago
- Active phishing campaign targets customers of 300 US banks3d ago
- Hackers target European refrigeration controllers causing food spoilage3d ago
- Ransomware victims reached record monthly high in October 20264d ago
- Microsoft records rise in email phishing threats during third quarter of 20264d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.