A financially motivated hacking group based in Cambodia has started using an artificial intelligence attack framework to target banks and other financial firms in Southeast Asia. Microsoft Threat Intelligence disclosed the campaign on 6 November 2026, warning that the group, tracked as Storm-3358, began using the agentic AI framework ARTEX in October.

ARTEX is an open-source framework that chains AI agents together to run attacks with little human input. Microsoft observed Storm-3358 combining it with conventional tools to scan internet-facing systems, exploit flaws including anonymous file upload and server-side request forgery, and install remote access trojans. The group used three trojan families — WISP, vshell and AdaptixC2 — downloaded by its agents using ordinary utilities such as netcat and curl.

Storm-3358 mainly targets financial organisations in Southeast Asia, with a smaller number of large financial firms elsewhere. Microsoft has named no victim and given no victim count, and says most of its published indicators were still active on 6 November.

From spies to financial crime

The campaign matters because ARTEX abuse has crossed from state-aligned actors to ordinary cybercrime. Microsoft previously linked ARTEX to a China state-aligned group behind the ConnectWise cloud backup compromise and to attacks on South Korean banks; Storm-3358's adoption shows the abuse widening.

The framework can also scan web applications, plant web shells, steal credentials, abuse cloud identities, run password spraying and dump databases — all at machine speed. Microsoft advises defenders to watch for AI-driven attack behaviour, such as a burst of varied requests, and suggests honeypots, decoys and fake wins to waste an agent's time. It has published indicators of compromise and hunting queries for its Defender products.