Storm-3358 hackers use the ARTEX AI tool against banks

In October 2026, Microsoft found that a group, Storm-3358, uses ARTEX against banks. ARTEX is a tool that lets AI agents, which are software that do tasks by themselves, attack systems. Microsoft says that the group is in Cambodia. Most banks that it attacks are in Southeast Asia. Some are large banks in other regions.

How it works

The ARTEX agents examine the internet for systems. They use weaknesses such as anonymous file upload and server-side request forgery. This is a method that makes a server send requests for the attacker.

They then install open-source remote access trojans. These are tools that give an attacker remote control:

• WISP
• vshell
• AdaptixC2

The numbers

Microsoft gave no count of victims and no test results. It says that decoys, tarpits and fake wins cut the attack traffic to important systems. A tarpit makes an agent use its time for no result. A fake win tells the agent that its task is done.

What is not known

Microsoft says that a stop of the usual marks of the tools does not stop an agent. The agent changes them fast. A sign of an agent is many tries in a short time.

Insight: One shared tool lets many groups attack

CrowdStrike, Zscaler and Google name a hacker from China, an operator and a group, UNC7228, as users of ARTEX. Microsoft names one more group. Each source names a different group for one tool. This looks like a cause to find the behavior and not the group name. Look for machine speed.