In This Article
An attack that used to need a team of skilled operators can now run on a free AI tool, pointed at your institution and working through the night.
On November 6, 2026, Microsoft Threat Intelligence reported that a criminal group it tracks as Storm-3358 began targeting financial-sector organizations in October with ARTEX, an agentic AI offensive framework. Agentic means the tool runs AI agents that take each step of an intrusion on their own, from scanning to stealing data, with little human direction.
"The threat actor that Microsoft Threat Intelligence tracks as Storm-3358 is a Cambodia-based intrusion cluster that primarily targets financial organizations in Southeast Asia, in addition to a smaller number of large financial organizations globally."
Microsoft names no US bank, credit union or mortgage company among the targets. The reason this report belongs on a US institution's desk is the tool. ARTEX is open source, and Censys counted more than 1,400 exposed copies of its control console on the internet in early November. Salesforce's threat intelligence team now treats it as "an accessible capability for numerous threat actors."
This guide is for IT and security leaders at credit unions, banks, and mortgage companies running Microsoft 365. ABT is a Tier-1 Microsoft Cloud Solution Provider serving 750+ financial institutions, and we manage the Microsoft 365 tenants of many of them.
The short version: the techniques ARTEX automates are familiar, and the speed is new. The Microsoft detection built for this activity requires a license that Microsoft 365 Business Premium alone doesn't include. An attack that runs at machine speed needs containment that runs at any hour.
What Microsoft reported about Storm-3358
Microsoft's report describes Storm-3358 using ARTEX together with ordinary automated tools to "scan systems connected to the public internet, exploit security flaws including anonymous file upload and server-side request forgery (SSRF), and install open-source remote access trojans (RATs)." The group used three of those trojans, WISP, vshell and AdaptixC2, to stay inside and move between systems.
Anonymous file upload means a web form that accepts files from anyone. Server-side request forgery tricks a web server into making requests on the attacker's behalf, often to internal systems the attacker can't reach directly. Both live in internet-facing web applications, the portals and forms that a customer, member or borrower uses.
Microsoft also lists what else ARTEX agents can do. They "can also perform brute-force password attacks, password spraying, API enumeration and abuse, and database dumping." Then the part that changes the defender's job: "Agentic tools like ARTEX can leverage compromised credentials and systems at machine speed to move laterally, escalate privileges, and exfiltrate data."
Storm-3358 follows an earlier ARTEX campaign against banks. In October, CrowdStrike reported a campaign against South Korean financial organizations that ended in stolen data and assessed the attacker as likely financially motivated. At one bank, CrowdStrike writes, the attacker "reportedly breached a loan progress inquiry service used by financial brokers." Our Black October guide for credit unions covered that campaign as one thread of a rough month.
How an ARTEX agentic AI attack runs
Microsoft's October 21 report on a separate ARTEX campaign describes the framework as "a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction." An LLM, or large language model, is the kind of AI behind today's chatbots. Pieced together from Microsoft's reports, an ARTEX intrusion of the kind Storm-3358 runs looks like this:
Agents sweep internet-facing systems with standard tools such as Nmap, curl and headless browsers.
A weak web application gives way: an anonymous file upload or a server-side request forgery flaw.
Agents download remote access trojans with curl or netcat and plant web shells, small scripts that let them control the server from outside.
Passwords come from public sources, from compromised systems and from spraying common passwords at many accounts.
Compromised cloud identities carry the agent to new systems and out with the data.
Every step in that chain has been in attacker playbooks for years. Salesforce's November 12 analysis puts it in two sentences: "The techniques themselves are not necessarily new. The agentic operating model is."
A free tool, old techniques, new speed
The new operating model shows up as time. Storm-0940, a China-state aligned actor, used ARTEX to target hundreds of organizations across industries, financial services included. In the October 21 report, Microsoft says those ARTEX-driven attacks produced "multiple instances where the time from initial targeting to privileged access was less than 3 hours." In a November 5 report on exposed secrets, the clock ran faster still:
Volume comes with speed. In its October 21 report, Microsoft describes a Storm-0940 ARTEX campaign that sprayed passwords at 327 accounts across eight organizations between October 10 and 14. It produced more than 151,000 failed sign-ins, peaking at 2,900 failures per minute on October 11, and Microsoft observed no successful authentication. Lockout responses made up nearly 98% of the activity.
The tool itself costs nothing. Censys reports that ARTEX was published on GitHub on July 26, 2026, and that as of November 4 it saw "1,465 hosts running an exposed ARTEX console," about 815 distinct-looking deployments. The original repository has since come down, and Salesforce notes that "community forks of the repository continue to circulate."
Put those facts together and the risk for a $500 million credit union is plain. The group in Microsoft's report mainly targets financial organizations in Southeast Asia, plus a smaller number of large financial organizations globally. The same software is in the hands of anyone who downloaded a fork. Reporting on ARTEX-linked attacks has pointed to the basics: TechCrunch reported that many involved "guessing weak or known passwords, and a lack of multi-factor authentication."
The detection Microsoft names needs Entra ID P2
Microsoft's report points defenders first to Microsoft Entra ID Protection, the service that scores each sign-in for risk. Its wording is specific: "Identity and sign-in activity from known threat actor infrastructure, including from agentic frameworks like ARTEX, generate Verified threat actor IP risk detections delivered at high risk."
Microsoft Learn's list of risk detections marks Verified threat actor IP as a real-time, Premium detection, and states the license requirement as Microsoft Entra ID P2. Microsoft 365 Business Premium, Microsoft's plan for organizations of up to 300 users, includes Entra ID P1. On P1, Microsoft says, premium detections arrive "titled Additional risk detected without risk detection details."
The policies that act on risk follow the same line. Microsoft's ID Protection license table lists sign-in and user risk policies as unavailable on Free and P1 and available on P2.
| What you want | Business Premium (Entra ID P1) | With Entra ID P2 |
|---|---|---|
| Verified threat actor IP detection, with details | Shown as "Additional risk detected," no details | Real-time detection with details |
| Password spray detection, with details | Shown as "Additional risk detected," no details | Fires when an attacker validates a real password |
| Sign-in risk policy (require multifactor authentication, or MFA, at Medium or High) | Not available | Available |
| User risk policy (require remediation at High) | Not available | Available |
| MFA and Conditional Access by user, app and location | Available | Available |
Microsoft offers P2 to Business Premium customers through an add-on. Microsoft Defender Suite for Microsoft 365 Business Premium lists at $10.00 per user per month, paid yearly, for up to 300 users. Alongside Entra ID P2 it adds Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps.
Plan it for every user: a partial rollout leaves the users outside it on P1, and an agent spraying passwords tries everyone. ABT is a Tier-1 Microsoft Cloud Solution Provider, so the Defender Suite goes on your ABT quote like the rest of your Microsoft licensing: as its own line, at Microsoft price.
On Business Premium alone, MFA and Conditional Access defend against the password attacks ARTEX automates, and the tenant sees a high-risk sign-in only as "Additional risk detected," with no detail. The detection and the risk policies Microsoft built for this activity come with Entra ID P2.
Our comparison of E3, E5 and Business Premium for financial institutions covers the wider licensing decision.
Seven checks for this month
These checks follow the ARTEX chain from the outside in. Business Premium covers the MFA, legacy authentication and risk detection checks as it stands. The risk policies need Entra ID P2 and the decoy account, called a honeytoken, needs Defender for Identity, and Defender Suite for Business Premium includes both.
Storm-3358 got in through web apps, so start with an inventory of portals, upload forms and vendor-hosted pages that carry your name. Microsoft Defender External Attack Surface Management "continuously discovers and maps your digital attack surface." Ask each vendor whether its file upload accepts anonymous users.
Require MFA on every account, block legacy authentication, and look hard at accounts no person signs into. Our guides to the Conditional Access password spray gap and to service account password spray walk through both.
Open ID Protection in the Entra admin center and review risk detections and risky sign-ins. On P1, a run of "Additional risk detected" entries is a signal to investigate the sign-in logs by hand.
Microsoft's recommended settings: require multifactor authentication "when sign-in risk level is Medium or High," and require risk remediation "when user risk level is High."
Microsoft lists Defender for Endpoint alerts tied to this activity, including "Suspicious port scan activity," "Possible Web Server compromise activity," "Possible reverse shell" and "Suspicious curl behavior." Those alerts fire only on servers Defender covers, so confirm that every internet-facing web server is onboarded.
Microsoft saw an agentic framework send GitHub large volumes of secret searches that "often included the name of a target organization." Search public repositories for your institution's name and domains, and rotate anything you find, because exposed credentials "remain usable until revoked or rotated."
Tag a dormant account as a honeytoken in Microsoft Defender for Identity. "Any sign-in from a honeytoken account triggers an alert." The next section explains why traps suit this attacker.
Agents work nights and weekends, so test each check against the hours your team is away.
At 11 PM on a Friday, an agent finds a loan document upload page on a vendor-hosted portal, gets a web shell on the server and starts spraying passwords at your Microsoft 365 accounts. Your IT team left at 5.
Microsoft's October report says agents "can work around the clock, on weekends, and on holidays." If one password holds and the only sign of it is a detection nobody reads until Monday, the agent has had the weekend.
Shrinking that weekend to seconds is the job of Guardian MxDR. Its automated detection "watches Microsoft Defender, Entra ID, and Purview signals around the clock and contains threats in seconds." At Guardian Contain and above, "critical risk detections trigger pre-authorized containment, including session revocation, in seconds at any hour, with no human in the loop."
Automation acts on the signals your licenses produce, which makes Entra ID P2 part of the response plan as well as the detection plan.
Decoys work on agents
An AI agent chases whatever looks valuable and reports success when its goal looks met. Microsoft's guidance turns that against it: "Honeypots and decoy surfaces such as Microsoft Sentinel Deception give the agent attractive but worthless targets to pursue. Tarpits consume the agent's time and budget. Fake wins present convincing evidence that the agent's objective is complete, which can cause it to stop on a false success."
In Microsoft's testing, these controls "helped reduce the attack traffic reaching real assets and produced high-confidence, attribution-quality signal."
Two traps fit a community institution. The Defender for Identity honeytoken tag from the checklist turns a dormant account into an alarm. For Azure, the Microsoft Sentinel Deception (Honey Tokens) solution plants decoy keys and secrets in Azure Key Vault. Microsoft offers it "in a community supported model," so treat it as a tool your team or provider maintains.
Microsoft's report adds a caution about fingerprints. ARTEX uses common tools with distinctive default user agent strings, and Microsoft says that "blocking network traffic with these characteristics will not stop an attack by an AI agent, which will quickly change them." Use those strings to raise an alert, and keep blocking for the controls that hold whatever the agent changes.
Microsoft's IP list is a hunting aid
Microsoft published sample IP addresses for Storm-3358's servers and notes that "threat actors regularly use proxies and virtual private networks (VPNs) to change the source IP address." Search your logs for them, and rely on MFA, risk policies and Defender alerts for protection, since those keep working after the addresses change.
Agents move faster than a ticket queue
Microsoft saw ARTEX-driven attacks reach privileged access in under three hours, more than once. Guardian Contain answers with pre-authorized automated containment that revokes a compromised session in seconds at any hour.
Write the response plan for machine speed
New York's financial regulator saw this coming. In October 2024 the New York State Department of Financial Services issued guidance on AI and cybersecurity to the institutions it regulates:
"Another major risk associated with AI is the ability of threat actors to amplify the potency, scale, and speed of existing types of cyberattacks."
The letter speaks to New York-regulated entities, and the point travels: your incident response plan was probably written for a human attacker who works in shifts. Salesforce sets the bar for an agentic attack in one line: "Know how to disable an integration, revoke tokens, and reset credentials within hours."
- Name who can disable a user account, revoke sessions and reset credentials at 2 AM on a Sunday, and who backs them up.
- Pre-approve the containment steps that run without a meeting, such as session revocation for a high-risk sign-in.
- Decide in advance who calls the vendor that hosts your internet-facing portal.
- Preserve the evidence while you contain: export sign-in and audit logs alongside the pre-approved steps, and before any cleanup or deletion.
For a team that goes home at 5, the first bullet is the hard one. At Guardian Resolve, "a human is on the incident at any hour: automation contains in seconds, and when it does not, our on-call engineer engages immediately, day or night."
Our Microsoft 365 incident response plan guide covers the full playbook, and our Key Eater guide covers what to ask a provider that holds access to your tenant.
How ABT helps
Microsoft's report puts the defender's side of the problem in one sentence: "As these capabilities evolve, defenders must similarly use AI to investigate and respond across large environments." For a community institution, the practical form of that is automation that acts before a person can.
M365 Guardian configures Conditional Access and MFA enforcement through Entra ID, and sign-in risk policies on tenants that hold Entra ID P2. Guardian Contain "adds round-the-clock detection across identity, endpoint, email, and cloud apps on Microsoft Defender XDR signals," correlated by ABT's own detection engine, with the automated containment described above. Guardian Respond adds ABT security engineers who investigate and remediate covered incidents during business hours. Your exact severity definitions and response targets are set out in your service agreement.
Guardian MxDR watches the identity half of the ARTEX chain, steps 4 and 5 above. Its identity coverage looks for "Brute force, credential stuffing, token theft, and privilege escalation attempts detected through Entra ID Protection and Conditional Access signals." That is the work an agent does once it holds a list of passwords.
Our Guardian page draws the licensing line: Business Premium "includes Microsoft Entra ID P1," and "examiners increasingly expect risk-based Conditional Access (Microsoft Entra ID P2) and around-the-clock monitoring that Business Premium alone does not include." ARTEX is a concrete reason to close that gap. "Your Microsoft licensing is quoted separately, at Microsoft price."
The free ABT Security Assessment reviews MFA coverage, Conditional Access policies, legacy authentication exposure, admin account hygiene and guest access settings, and lists license optimization opportunities. Most assessments complete within two weeks, through a read-only connection, with a written report and a review call with an ABT security engineer. That call is the right place to settle the Entra ID P2 question for your tenant.
Know where your identity controls stand before an AI agent tests them
ABT's free Security Assessment reviews MFA coverage, Conditional Access policies, legacy authentication exposure, admin account hygiene and guest access settings, and flags license optimization opportunities. You get a written report and a 90-day hardening roadmap.
Frequently Asked Questions
ARTEX is an open-source agentic penetration testing framework published on GitHub in July 2026. Microsoft describes it as a system of AI agents that run an attack from reconnaissance through data exfiltration with little human interaction. It was built for authorized testing, and criminal and state-aligned groups now use it against real organizations, including banks.
Storm-3358 is Microsoft Threat Intelligence's name for a Cambodia-based, financially motivated intrusion cluster. Microsoft reported on November 6, 2026 that it began using ARTEX against financial-sector organizations in October, exploiting web application flaws and installing remote access trojans. It mainly targets Southeast Asia plus a smaller number of large financial organizations globally.
Microsoft's Storm-3358 report names no US institution, and public reporting on ARTEX attacks against financial institutions has centered on Southeast Asia, South Korea and India. The tool is free, though, and Censys counted 1,465 exposed ARTEX consoles in early November. Salesforce assesses it as an accessible capability for numerous threat actors, so plan as if any attacker can run it.
Partly. Business Premium includes Entra ID P1. Sign-ins from known threat actor infrastructure, including ARTEX infrastructure, raise a Verified threat actor IP detection, and that detection and risk-based policies require Entra ID P2. P1 shows it as "Additional risk detected" without details. Microsoft Defender Suite for Microsoft 365 Business Premium adds P2 at $10.00 per user per month, paid yearly.
Blocking Microsoft's published ARTEX addresses helps for a short time at most. Microsoft notes that threat actors regularly change source addresses through proxies and VPNs, and that AI agents quickly change the tool fingerprints defenders look for. Use the indicators to search your logs, and rely on MFA, risk-based Conditional Access and Defender alerts for protection.
Start with the basics ARTEX exploits: MFA on every account, legacy authentication blocked, and a list of every internet-facing web application. Then check whether your tenant holds Entra ID P2 for risk detections and risk policies, and decide who can revoke sessions and disable accounts at night, because agents work around the clock.
ABT's Guardian MxDR watches Microsoft Defender, Entra ID, and Purview signals around the clock and contains threats in seconds. At Guardian Contain and above, pre-authorized containment, including session revocation, runs at any hour. At Guardian Resolve, an ABT on-call engineer engages day or night when automation does not contain the incident. Full identity risk detail requires Microsoft Entra ID P2.