ARTEX Abuse Expands as Cybercriminals Target Financial Organizations

Summary

Financially motivated threat actor Storm-3358 is using the ARTEX agentic AI offensive framework to target financial organizations. The actor leverages AI to accelerate scanning, exploitation, and lateral movement at machine speed. ARTEX is combined with conventional offensive tools to exploit web vulnerabilities and deploy multiple remote access trojans.

Investigation

Microsoft Threat Intelligence observed Storm-3358 using ARTEX to scan internet-facing systems and exploit weaknesses such as SSRF and anonymous file uploads. The investigation identified WISP, vshell, and AdaptixC2 RATs used for persistence. The actor also abuses compromised cloud identities and stolen credentials to support data exfiltration.

Mitigation

Organizations should deploy defensive honeypots, decoys, and tarpits to redirect autonomous AI agents away from legitimate assets. Microsoft Sentinel Deception can help generate high-confidence, attribution-quality signals. Security teams should also monitor for distinctive network traffic patterns associated with highly automated scanning and exploitation tools.

Response

When malicious activity is detected, security teams should review sign-in activity through Microsoft Entra ID Protection to identify risky identity signals. Endpoint telemetry should be analyzed with Microsoft Defender for Endpoint for suspicious process execution and shell activity. Organizations should also hunt for unauthorized use of utilities such as curl or netcat across affected environments.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to establish a persistent C2 channel using the ARTEX toolkit. To evade simple signature-based detection of just a RAT or just a network tool, they attempt to combine them in a single execution string. The goal is to run a command that mimics the specific string pattern nc.exe -l -p 4444 -e WISP.exe to see if the SOC receives an alert. This simulates the moment the ARTEX agent attempts to leverage Netcat for its remote access capabilities.

• Regression Test Script:

  # This script simulates the specific command line pattern required to trigger the 'AND' condition.
  # Note: We use 'cmd /c' to ensure the command line is captured clearly in process telemetry.
  
  $SimulatedCommand = "C:tempnc.exe -lvp 4444 -e WISP.exe"
  Write-Host "Simulating ARTEX pattern: $SimulatedCommand"
  
  # We use start-process to trigger the creation of a process with the specific command line
  # We use a dummy argument to prevent the script from actually trying to execute a non-existent nc.exe if possible, 
  # but for the sake of the rule, the string MUST be in the CommandLine field.
  Start-Process "cmd.exe" -ArgumentList "/c echo $SimulatedCommand"

• Cleanup Commands:

  # Remove any artifacts created during simulation
  Remove-Item -Path "C:tempnc.exe" -ErrorAction SilentlyContinue
  Write-Host "Cleanup complete."