Storm-3358 uses ARTEX to compromise systems in a campaign targeting financial firms
Microsoft observed Storm-3358 exploit weaknesses such as anonymous uploads and server-side request forgery, then deploy remote-access trojans. The campaign primarily targets Southeast Asian financial organizations. Microsoft did not publish victim counts or losses.
- Disclosed
- Nov 7, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Financial firms, mainly in Southeast Asia, with exploitable internet-facing services.
- ARTEX · financial sector · web exploitation
- In the wild
- Yes
- Microsoft observed exploitation and deployment of RATs on compromised systems.
What happened
Microsoft tracks Storm-3358 as a financially motivated intrusion cluster based in Cambodia. It began targeting financial organizations in October 2026, primarily in Southeast Asia, with a smaller set of large financial organizations elsewhere. Microsoft observed ARTEX operating alongside conventional tools. The attackers scanned public-facing systems, exploited flaws such as anonymous file upload and server-side request forgery (SSRF), and deployed WISP, vshell and AdaptixC2 for persistence and lateral movement. An exploitable web function is the prerequisite for those entry paths. Actual impact depends on what the service can execute or reach.
Microsoft also describes web shells, abuse of compromised cloud identities and data exfiltration across recent ARTEX attacks more broadly. Microsoft did not confirm whether Storm-3358 exfiltrated data in this campaign. Microsoft did not disclose victim names, a confirmed victim count, loss totals, affected product versions or a CVE. The rating reflects observed exploitation and remote-access tool deployment. The shared use of ARTEX does not establish a link to the ConnectWise cloud backup incident or the iOS signing campaigns.
Crime-scene timeline
Oct 19, 2026
Earliest published infrastructure observation
Microsoft first saw one listed ARTEX server on this date. It dates the start of financial-sector targeting only to October.
Oct 28, 2026
Microsoft first sees a second listed ARTEX server
Nov 2, 2026
Microsoft first sees three WISP command-and-control nodes
Nov 4, 2026
Microsoft first sees two additional ARTEX servers and another command-and-control server
Nov 7, 2026, 02:44 UTC
Microsoft publishes its findings
Microsoft describes Storm-3358 exploitation and names three remote-access tools. The report page displays November 6 and its publication metadata gives November 7 in UTC.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Microsoft Threat IntelligencePrimaryReports exploitation by Storm-3358, its target profile, RAT deployment, eight sample infrastructure addresses and hunting guidance.