Observed incident

Microsoft tracks ARTEX-assisted intrusions against financial organizations

Reported

Published here

What happened

Microsoft observed Storm-3358 using ARTEX alongside conventional tools against financial organizations in October. The cluster primarily targets Southeast Asia and also targets some large financial institutions elsewhere.

Parties and reporting

AI tools and systems: ARTEX, Remote access software

Outcome

Microsoft observed remote access software installed on compromised systems for persistence and movement within networks. It did not name victims or report a loss figure, incident count or completed recovery.

Operating lesson

Correlate bursts of web requests with new processes or outbound connections on exposed servers. Investigate the sequence even when individual requests look routine.

Evidence and limits

Microsoft describes Storm-3358 as a financially motivated, Cambodia-based cluster. Cambodia locates the suspected operator. The report identifies no individual victim country or connection to the separate South Korean ARTEX investigation.

Sources