EN PT-BR
← Voltar ao feed
high banking financial_services

Storm 3358 uses AI-enabled Artex pen-testing tool in financially motivated attacks on banks

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 12:50 · coletado há 1 hora

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

A financially motivated group tracked by Microsoft as Storm 3358 and based in Cambodia has used the AI-enabled pen-testing framework Artex against banking and other firms in Southeast Asia and elsewhere, according to a Microsoft Threat Intelligence report published on a Friday. The actor began in October 2026 and combined Artex with conventional tools. The article presents the campaign as the latest in a growing wave of attacks that use Artex and other pen-testing tools to automate intrusions. The Microsoft post linked from the article was not opened during this research, so the account below rests on the article alone.

Detalhes técnicos

  • The actor reportedly exploited server-side request forgery and anonymous file-upload flaws before installing remote-access Trojans. The article names no CVE for either flaw.
  • For persistence and lateral movement, the actor used vshell and AdaptixC2. Utilities such as curl and netcat were used to download the RATs onto compromised systems.
  • The article describes Artex as a tool that lets attackers automate operations well beyond human capabilities.
  • Context from the same article: Indian officials reported a threat actor tracked as Crafty Falcon using Artex with Cairn and PentAGI against fintechs, digital lenders and non-banking financial companies. The article also cites earlier Artex-linked activity against South Korean banks and dozens of Japanese companies.

Remediação

  • The article notes that honeypots or decoys can sometimes divert autonomous AI attackers, because they may convince the agent that an attack has succeeded and consume its time and resources.
  • Defenders should review internet-facing applications for SSRF and unrestricted file-upload paths, and hunt for vshell, AdaptixC2, and curl or netcat downloads from servers.
  • The article reports no vendor patch for Artex, so no fix section is included.

Linha do tempo

  1. cybersecuritydive.com ↗ · pub. 09/11/2026 12:50 · coletado 09/11 14:01 primeiro registro só resumo do feed

    Storm 3358 uses AI-enabled Artex pen-testing tool in financially motivated attacks on banks

    ler a análise desta fonte

    A financially motivated group tracked by Microsoft as Storm 3358 and based in Cambodia has used the AI-enabled pen-testing framework Artex against banking and other firms in Southeast Asia and elsewhere, according to a Microsoft Threat Intelligence report published on a Friday. The actor began in October 2026 and combined Artex with conventional tools. The article presents the campaign as the latest in a growing wave of attacks that use Artex and other pen-testing tools to automate intrusions. The Microsoft post linked from the article was not opened during this research, so the account below rests on the article alone.

    Technical Details

    • The actor reportedly exploited server-side request forgery and anonymous file-upload flaws before installing remote-access Trojans. The article names no CVE for either flaw.
    • For persistence and lateral movement, the actor used vshell and AdaptixC2. Utilities such as curl and netcat were used to download the RATs onto compromised systems.
    • The article describes Artex as a tool that lets attackers automate operations well beyond human capabilities.
    • Context from the same article: Indian officials reported a threat actor tracked as Crafty Falcon using Artex with Cairn and PentAGI against fintechs, digital lenders and non-banking financial companies. The article also cites earlier Artex-linked activity against South Korean banks and dozens of Japanese companies.

    Remediation

    • The article notes that honeypots or decoys can sometimes divert autonomous AI attackers, because they may convince the agent that an attack has succeeded and consume its time and resources.
    • Defenders should review internet-facing applications for SSRF and unrestricted file-upload paths, and hunt for vshell, AdaptixC2, and curl or netcat downloads from servers.
    • The article reports no vendor patch for Artex, so no fix section is included.