Microsoft tracks Cambodia-based hacking group using agentic tool against banks

Microsoft's Threat Intelligence team reported that in October 2026, a financially motivated hacking group it calls Storm-3358, based in Cambodia, started using an agentic offensive hacking framework called ARTEX to target financial organizations, primarily in Southeast Asia. Microsoft observed the group combining ARTEX with automated scans looking for servers with anonymous file upload features and server-side request forgery vulnerabilities, common weaknesses attackers exploit to gain initial access. After breaking in, the attackers downloaded several remote-access tools, including WISP, vshell, and AdaptixC2, using common system utilities like netcat and curl to move the tools onto compromised systems. This November 6 report builds on Microsoft's earlier research into ARTEX, which had previously been linked to incidents involving exposed GitHub secrets and activity connected to the ConnectWise remote management platform. The expansion of ARTEX use into the financial sector signals that agentic, semi-automated hacking tools are becoming more common among cybercriminal groups, potentially making attacks faster and requiring less manual effort from the attackers themselves.

Why it matters

Agentic hacking frameworks spreading into the financial sector suggest attackers are increasingly automating steps that once required manual effort.

Source: Microsoft