{
  "id": "storm-3358-finance",
  "url": "https://ohshit.app/incidents/storm-3358-finance/",
  "title": "Storm-3358 uses ARTEX to compromise systems in a campaign targeting financial firms",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-07",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "ARTEX",
    "financial sector",
    "web exploitation"
  ],
  "ecosystems": [],
  "summary": "Microsoft observed Storm-3358 exploit weaknesses such as anonymous uploads and server-side request forgery, then deploy remote-access trojans. The campaign primarily targets Southeast Asian financial organizations. Microsoft did not publish victim counts or losses.",
  "splash": "Financial firms, mainly in Southeast Asia, with exploitable internet-facing services.",
  "wipe": "Isolate compromised hosts, preserve evidence, close exposed upload and request paths, and replace affected credentials.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Contain compromised systems and preserve evidence",
      "hint": "Take affected hosts out of service and isolate them from other systems. Preserve web, proxy, egress, identity and endpoint logs and capture affected files and volatile evidence through your incident-response process. Check whether affected service accounts were used and what resources they could access."
    },
    {
      "title": "Close exploitable upload and outbound request paths",
      "hint": "Require authentication and authorization for uploads and keep uploaded files outside executable web paths. Restrict server-side URL fetching to approved destinations and restrict egress to internal and metadata endpoints. Fix the affected application before returning it to service."
    },
    {
      "title": "Hunt for related infrastructure and behavior",
      "hint": "Check proxy, firewall and endpoint records for WISP nodes 199.19.95.66, 199.19.95.67 and 199.19.95.68, ARTEX servers 91.92.240.238, 85.11.168.45, 178.16.54.129 and 31.77.229.35, and C2 server 85.11.167.52. Correlate fast retries, unexpected PHP shell execution and downloads by curl or netcat with unauthorized uploads and process ancestry. Use the report’s Defender and Sentinel queries if available. A match alone does not prove compromise. The sample Sentinel query uses 178.15.54.129 where the table lists 178.16.54.129. Verify the discrepancy before blocking either address. Figure 1 adds pivots for 85.11.167.52 on TCP 8444 and HTTP 8093 (/mcp), and 199.19.95.66 on HTTP 8097 (/gopher_8444.bin) and 8099 (/api/download/wisp-linux-amd64-76794b36f757). Check for /tmp/.g3 and .wf alongside those connections."
    },
    {
      "title": "Remove persistence and restore from trusted assets",
      "hint": "Identify and remove web shells and remote-access tooling, rebuild compromised hosts from trusted images and check adjacent systems for lateral movement. From a clean system, revoke and replace exposed application and service credentials, review cloud permissions and access logs, and monitor for recurrence after restoration."
    }
  ],
  "sources": [
    {
      "name": "Microsoft Threat Intelligence",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
      "says": "Reports exploitation by Storm-3358, its target profile, RAT deployment, eight sample infrastructure addresses and hunting guidance.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Microsoft observed exploitation and deployment of RATs on compromised systems.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 19, 2026",
      "title": "Earliest published infrastructure observation",
      "body": "Microsoft first saw one listed ARTEX server on this date. It dates the start of financial-sector targeting only to October."
    },
    {
      "date": "Oct 28, 2026",
      "title": "Microsoft first sees a second listed ARTEX server"
    },
    {
      "date": "Nov 2, 2026",
      "title": "Microsoft first sees three WISP command-and-control nodes"
    },
    {
      "date": "Nov 4, 2026",
      "title": "Microsoft first sees two additional ARTEX servers and another command-and-control server"
    },
    {
      "date": "Nov 7, 2026, 02:44 UTC",
      "title": "Microsoft publishes its findings",
      "body": "Microsoft describes Storm-3358 exploitation and names three remote-access tools. The report page displays November 6 and its publication metadata gives November 7 in UTC."
    }
  ],
  "body_markdown": "Microsoft tracks Storm-3358 as a financially motivated intrusion cluster based in Cambodia. It began targeting financial organizations in October 2026, primarily in Southeast Asia, with a smaller set of large financial organizations elsewhere. Microsoft observed ARTEX operating alongside conventional tools. The attackers scanned public-facing systems, exploited flaws such as anonymous file upload and server-side request forgery (SSRF), and deployed WISP, vshell and AdaptixC2 for persistence and lateral movement. An exploitable web function is the prerequisite for those entry paths. Actual impact depends on what the service can execute or reach.\n\nMicrosoft also describes web shells, abuse of compromised cloud identities and data exfiltration across recent ARTEX attacks more broadly. Microsoft did not confirm whether Storm-3358 exfiltrated data in this campaign. Microsoft did not disclose victim names, a confirmed victim count, loss totals, affected product versions or a CVE. The rating reflects observed exploitation and remote-access tool deployment. The shared use of ARTEX does not establish a link to the [ConnectWise cloud backup incident](/incidents/connectwise-cloud-backup/) or [the iOS signing campaigns](/incidents/artex-signing-campaigns/)."
}