In October 2026, Microsoft security researchers confirmed that the financially motivated threat actor Storm-3358 has expanded its operations to target the financial services sector using ARTEX, an agentic AI offensive framework. Unlike traditional malware campaigns that rely on pre-programmed payloads, ARTEX leverages autonomous AI agents to conduct reconnaissance, adapt to environmental defenses, and execute multi-stage attacks with minimal human intervention.
This shift represents a critical inflection point for security operations. Financial institutions—already high-value targets for cybercrime—now face adversaries capable of operating at machine speed, automatically discovering misconfigurations, generating context-aware phishing lures, and chaining exploits in real-time. Storm-3358's adoption of ARTEX signals that AI-assisted attacks have moved from proof-of-concept to operational reality.
If your organization operates in banking, payments processing, asset management, or fintech, you must assume that automated reconnaissance and exploitation attempts are already probing your perimeter. This article provides actionable detection engineering, threat hunting queries, and hardening guidance specifically tailored to counter agentic AI-driven intrusion campaigns.
Technical Analysis
Threat Actor Profile: Storm-3358
Microsoft Threat Intelligence classifies Storm-3358 as a financially motivated criminal group with a history of targeting payment processors and regional banks. Their traditional TTPs include:
- Initial Access: Phishing campaigns using macro-enabled documents and HTML smuggling
- Execution: PowerShell-based loaders and legitimate administrative tool abuse (PsExec, WMI)
- Persistence: Registry Run keys and scheduled tasks masquerading as system utilities
- Objective: Deployment of ransomware or direct wire-fraud via Business Email Compromise (BEC)
The integration of ARTEX fundamentally alters their operational tempo. Rather than manual hacking, Storm-3358 now deploys autonomous agents capable of:
- Autonomous Reconnaissance: ARTEX agents scan external-facing services, identify software versions, and cross-reference vulnerabilities against internal databases without human direction.
- Adaptive Social Engineering: The framework generates spear-phishing content using open-source intelligence (OSINT) scraped from LinkedIn and corporate websites, personalizing lures at scale.
- Automated Lateral Movement: Upon initial compromise, ARTEX agents attempt to enumerate Active Directory, identify high-value targets (such as payment administrators), and move laterally using harvested credentials.
- Dynamic Payload Generation: Rather than static executables, ARTEX generates polymorphic PowerShell and .NET payloads that evade signature-based detection by rewriting code structures for each deployment.
Attack Chain Analysis
Based on Microsoft's reporting, the ARTEX campaign against financial targets follows this pattern:
Phase 1: Reconnaissance & Initial Access
- Automated scanning of financial sector IP ranges for exposed Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), and web applications
- Generation of targeted phishing emails using AI-crafted content referencing specific employees and recent corporate events
- Use of
powershell.exewith base64-encoded commands to download secondary stages
Phase 2: Execution & Persistence
- ARTEX agents execute reconnaissance commands (
netstat -an,ipconfig /all,nltest /dclist:) to map the environment - Installation of persistence via Registry Run keys pointing to hidden directories (e.g.,
%APPDATA%\Microsoft\Windows\Update\) - Deployment of lightweight C2 implants that communicate via HTTPS to blend with legitimate traffic
Phase 3: Objective Execution
- Enumeration of financial applications, SWIFT interfaces, and payment processing systems
- Attempted credential dumping using automated exploitation of LSASS or saved browser credentials
- Deployment of ransomware or wire transfer fraud instructions
Exploitation Status
- Active Exploitation: Confirmed by Microsoft Security (October 2026)
- CVEs Involved: No specific CVE identifiers were disclosed in the initial reporting; ARTEX primarily exploits misconfigurations, weak credentials, and unpatched edge services rather than specific zero-days
- CISA KEV Status: Not applicable as of this writing (November 2026), though organizations should monitor CISA's Known Exploited Vulnerabilities catalog for any follow-on disclosures
Detection & Response
Defending against agentic AI frameworks requires shifting from static indicator-based detection to behavioral analytics that identify autonomous tooling patterns. The following detection content targets the specific TTPs observed in Storm-3358's ARTEX campaigns.
SIGMA Detection Rules
The following Sigma rules detect suspicious reconnaissance, persistence mechanisms, and encoded command execution consistent with ARTEX automated agents.
---
title: Automated System Reconnaissance - Agentic AI Pattern
id: 9e8d7c6b-5a4f-4e3d-8c2b-1a0f9e8d7c6b
status: experimental
description: Detects rapid sequential execution of reconnaissance commands typical of AI-driven attack frameworks
references:
- https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
- https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/11/06
tags:
- attack.discovery
- attack.t1082
- attack.t1016
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- '\powershell.exe'
- '\cmd.exe'
- '\wscript.exe'
- '\mshta.exe'
CommandLine|contains:
- 'netstat'
- 'ipconfig'
- 'nltest'
- 'arp -a'
- 'route print'
- 'systeminfo'
- 'whoami /priv'
- 'qwinsta'
- 'tasklist'
timeframe: 60s
condition: selection | count() > 5
falsepositives:
- Legitimate administrative scripts
- Network monitoring tools
level: medium
---
title: Persistence via Registry Run Key - Hidden Path
id: 8f7e6d5c-4b3a-2d1c-9e8f-7a6b5c4d3e2f
status: experimental
description: Detects registry persistence attempts using hidden directories or deceptive naming typical of automated malware deployment
references:
- https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
- https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/11/06
tags:
- attack.persistence
- attack.t1547.001
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|contains:
- '\CurrentVersion\Run\'
- '\CurrentVersion\RunOnce\'
Details|contains:
- '%APPDATA%\Microsoft\Windows\Update\'
- '%TEMP%\'
- '%PUBLIC%\Documents\'
- 'AppData\Local\Temp\'
condition: selection
falsepositives:
- Legitimate software updates
- IT deployment scripts
level: high
---
title: PowerShell Base64 Encoded Command Execution
id: 7c6b5a4f-3e2d-1c0b-9a8f-7e6d5c4b3a2f
status: experimental
description: Detects suspicious PowerShell execution with base64-encoded commands, common in AI-generated attack payloads
references:
- https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
- https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/11/06
tags:
- attack.execution
- attack.t1059.001
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|contains:
- ' -enc '
- ' -EncodedCommand '
- ' -e '
- ' [System.Convert]::FromBase64String'
- ' IEX '
- 'Invoke-Expression'
filter_length:
CommandLine|length: '>100'
condition: selection and filter_length
falsepositives:
- Legitimate administrative scripts
- Software deployment tools
level: high
Microsoft Sentinel KQL Hunting Queries
Use these KQL queries to hunt for ARTEX-related activity across your environment. These queries target the behavioral patterns of automated reconnaissance and AI-driven attack frameworks.
// Hunt for rapid-fire reconnaissance commands (agentic AI behavior pattern)
// Detects multiple discovery commands within short timeframes from same host
let timeframe = 5m;
let ReconCommands = dynamic(["netstat", "ipconfig", "nltest", "arp", "route print", "systeminfo", "whoami", "qwinsta", "tasklist", "wmic"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where ProcessCommandLine has_any (ReconCommands)
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| summarize Commands = make_set(ProcessCommandLine),
CommandCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by DeviceName, InitiatingProcessId, InitiatingProcessFileName
| where CommandCount >= 4 and (LastSeen - FirstSeen) <= timeframe
| project DeviceName, InitiatingProcessFileName, CommandCount, Commands, FirstSeen, LastSeen
| order by CommandCount desc
;
// Detect PowerShell execution with obfuscation and external network connectivity
// Identifies potential C2 communication or payload download typical of ARTEX
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| join kind=inner (
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("enc", "encodedcommand", "frombase64string", "invoke-expression", "iex")
) on DeviceId, ProcessId
| where RemoteUrl !contains "microsoft.com"
and RemoteUrl !contains "windowsupdate.com"
and RemoteIP !startswith "10."
and RemoteIP !startswith "192.168."
and RemoteIP !startswith "172.16."
| project TimeGenerated, DeviceName, ProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessAccountName
| order by TimeGenerated desc
;
// Hunt for suspicious persistence mechanism creation in financial sector
DeviceRegistryEvents
| where TimeGenerated > ago(24h)
| where RegistryKey has_any ("CurrentVersion\\Run", "CurrentVersion\\RunOnce")
| where RegistryValueData has_any ("%APPDATA%", "%TEMP%", "%PUBLIC%", "AppData\\Local\\Temp")
| where RegistryValueData !contains "OneDrive"
and RegistryValueData !contains "Teams"
and RegistryValueData !contains "Microsoft"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| order by TimeGenerated desc
Velociraptor VQL Hunt Artifact
Deploy this VQL artifact across your Windows fleet to hunt for ARTEX indicators including suspicious PowerShell execution, encoded commands, and anomalous network connections.
-- ARTEX Agentic AI Detection Hunt
-- Identifies processes with encoded commands, suspicious network connections, and reconnaissance activity
SELECT
Pid,
Name,
Exe,
CommandLine,
Username,
CreateTime,
Ppid,
get(ProcessId=Ppid).Name as ParentName,
get(ProcessId=Ppid).CommandLine as ParentCommandLine
FROM pslist()
WHERE
(
-- Detect encoded/obfuscated PowerShell typical of AI-generated payloads
(Name =~ 'powershell' OR Name =~ 'pwsh')
AND CommandLine =~ '(?i)(enc|encodedcommand|frombase64string|iex|invoke-expression)'
AND len(CommandLine) > 100
)
OR
(
-- Detect reconnaissance command patterns
CommandLine =~ '(?i)(netstat.*-an|ipconfig.*/all|nltest.*/dclist|arp.*-a|route.*print|systeminfo|whoami.*/priv)'
AND (ParentName =~ 'powershell|cmd|wscript|cscript|mshta')
)
OR
(
-- Detect suspicious network tools spawned from Office or script interpreters
Name =~ '(netstat|nslookup|ping|tracert|nbtstat)'
AND ParentName =~ '(winword|excel|powerpnt|outlook|wscript|cscript|mshta|rundll32)'
)
ORDER BY CreateTime DESC
Remediation & Hardening Script
Run the following PowerShell script with administrative privileges to harden systems against ARTEX-style attacks. This script disables Office macros by default (common initial access vector), enables PowerShell logging, and restricts WMI lateral movement.
# ARTEX Threat Mitigation Script - Financial Sector Hardening
# Run as Administrator on Windows 10/11 and Server 2016+
Write-Host "[+] Initiating ARTEX Threat Hardening Script" -ForegroundColor Green
# 1. Disable Office Macros by Default (Prevent phishing execution)
Write-Host "[+] Disabling Office Macros via Registry..." -ForegroundColor Cyan
$OfficePaths = @(
"HKCU:\Software\Microsoft\Office\16.0\Word\Security",
"HKCU:\Software\Microsoft\Office\16.0\Excel\Security",
"HKCU:\Software\Microsoft\Office\16.0\PowerPoint\Security"
)
foreach ($Path in $OfficePaths) {
if (!(Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
Set-ItemProperty -Path $Path -Name "VBAWarnings" -Value 4 -Force
Write-Host " Set VBAWarnings to 4 (Disable all) at $Path" -ForegroundColor Gray
}
# 2. Enable PowerShell Script Block Logging and Module Logging
Write-Host "[+] Enabling PowerShell Logging..." -ForegroundColor Cyan
$PSLoggingPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (!(Test-Path $PSLoggingPath)) { New-Item -Path $PSLoggingPath -Force | Out-Null }
Set-ItemProperty -Path $PSLoggingPath -Name "EnableScriptBlockLogging" -Value 1 -Force
Set-ItemProperty -Path $PSLoggingPath -Name "EnableScriptBlockInvocationLogging" -Value 1 -Force
$PSModulePath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
if (!(Test-Path $PSModulePath)) { New-Item -Path $PSModulePath -Force | Out-Null }
Set-ItemProperty -Path $PSModulePath -Name "EnableModuleLogging" -Value 1 -Force
New-Item -Path "$PSModulePath\ModuleNames" -Force | Out-Null
Set-ItemProperty -Path "$PSModulePath\ModuleNames" -Name "*" -Value "*" -Force
# 3. Restrict WMI Lateral Movement (Disable remote WMI except for specific admin accounts)
Write-Host "[+] Configuring WMI Restrictions..." -ForegroundColor Cyan
# Note: This sets restrictions; adjust SIDs for your environment
$WMISDDL = "O:BAG:BAD:(A;;0x1;;;BA)(A;;0x1;;;S-1-5-32-548)" # Allow only Administrators and Account Operators
Set-WmiInstance -Path "__systemsecurity=@" -Namespace "root\cimv2" -Arguments @{SecurityDescriptor=$WMISDDL} -ErrorAction SilentlyContinue
# 4. Disable PowerShell 2.0 (Legacy attack surface)
Write-Host "[+] Disabling PowerShell 2.0..." -ForegroundColor Cyan
Disable-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2" -NoRestart -ErrorAction SilentlyContinue
Disable-WindowsOptionalFeature -Online -FeatureName "MicrosoftWindowsPowerShellV2Root" -NoRestart -ErrorAction SilentlyContinue
# 5. Enable Attack Surface Reduction (ASR) Rules if Windows Defender is present
Write-Host "[+] Configuring Windows Defender ASR Rules..." -ForegroundColor Cyan
if (Get-MpComputerStatus) {
# Block Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled
# Block execution of potentially obfuscated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC" -AttackSurfaceReductionRules_Actions Enabled
# Block Win32 API calls from Office macros
Add-MpPreference -AttackSurfaceReductionRules_Ids "92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B" -AttackSurfaceReductionRules_Actions Enabled
Write-Host " ASR rules enabled for Office and Script blocking" -ForegroundColor Gray
}
# 6. Restrict SMB Signing (Require signing to prevent relay attacks)
Write-Host "[+] Enforcing SMB Signing..." -ForegroundColor Cyan
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "RequireSecuritySignature" -Value 1 -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name "EnableSecuritySignature" -Value 1 -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name "RequireSecuritySignature" -Value 1 -Force
# 7. Create detection directory and copy baseline
Write-Host "[+] Creating Baseline Snapshot for Comparison..." -ForegroundColor Cyan
$BaselineDir = "C:\SecurityBaseline"
if (!(Test-Path $BaselineDir)) { New-Item -ItemType Directory -Path $BaselineDir -Force }
Get-Process | Export-Csv -Path "$BaselineDir\Processes_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Get-Service | Export-Csv -Path "$BaselineDir\Services_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Write-Host "[+] Hardening Complete. Review Event Viewer (Microsoft-Windows-PowerShell/Operational) for Script Block Logging." -ForegroundColor Green
Write-Host "[!] WARNING: Test in development environment before production deployment. Some restrictions may affect legacy applications." -ForegroundColor Yellow
Remediation and Strategic Recommendations
Immediate Actions (24-48 Hours)
-
Review Financial Transaction Integrity: Given Storm-3358's financial motivation, implement out-of-band verification for all wire transfer requests, especially those involving new beneficiaries or changes to existing payment instructions.
-
Deploy Behavioral Analytics: ARTEX generates high-volume, rapid-fire reconnaissance. Ensure your SIEM correlates multiple discovery commands within short windows rather than relying on individual command detections.
-
Audit PowerShell Usage: ARTEX heavily relies on PowerShell for automation. Inventory legitimate PowerShell use cases and implement Constrained Language Mode or application whitelisting (WDAC/AppLocker) for all other users.
-
Enable PowerShell Logging: If not already enabled, activate Script Block Logging and Module Logging across the enterprise. Forward these logs to your SIEM for correlation with the Sigma rules provided above.
Strategic Hardening (30-90 Days)
-
Implement Zero Trust Architecture: ARTEX relies on lateral movement and privilege escalation. Segment your network to isolate payment processing systems, SWIFT terminals, and treasury workstations from general corporate IT.
-
AI-Driven Defense in Depth: Deploy defensive AI solutions that can match the speed of ARTEX attacks. Consider implementing:
- User and Entity Behavior Analytics (UEBA) tuned for financial sector baselines
- Automated response playbooks that isolate hosts upon detection of reconnaissance patterns
- Deception technology (honeypots, honey credentials) to detect AI-driven lateral movement
-
Supply Chain Vigilance: As an agentic framework, ARTEX may be offered as-a-service to other criminal groups. Monitor for signs of multiple threat actors using similar TTPs, which would indicate broader ARTEX proliferation.
-
Employee Training: Update security awareness programs to address AI-generated phishing. These lures are highly personalized and grammatically perfect, making traditional "spot the typo" training obsolete. Focus on verification procedures for financial transactions and unexpected credential requests.
Vendor Coordination
- Microsoft Defender for Endpoint: Ensure cloud-delivered protection and tamper protection are enabled. Microsoft has likely updated Defender signatures to detect ARTEX components, but behavioral blocking is essential given the polymorphic nature of AI-generated payloads.
- Threat Intelligence Sharing: Join FS-ISAC (Financial Services Information Sharing and Analysis Center) to receive real-time IOCs and TTPs specific to Storm-3358 and ARTEX campaigns targeting financial institutions.
Conclusion
Storm-3358's deployment of ARTEX against the financial sector marks the operationalization of agentic AI in cybercrime. Traditional security controls designed to stop human hackers are insufficient against autonomous agents that can adapt, learn, and execute at machine speed.
Financial institutions must respond by accelerating their own adoption of AI-driven defense mechanisms, implementing strict behavioral analytics, and hardening environments against automated reconnaissance. The detection rules and hardening scripts provided here offer immediate tactical value, but long-term resilience requires a fundamental shift toward autonomous security operations capable of matching the speed and scale of AI-powered adversaries.
Monitor Microsoft's Threat Intelligence blog for updated indicators of compromise and additional technical details as this campaign evolves.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.