Science & Tech · Cybersecurity · 4 hrs ago
AI Pen-Testing Tool Artex Used in Attacks on Financial Firms
A Cambodia-based group tracked as Storm 3358 began attacks in October against financial firms and other organizations.
The group combined Artex with conventional tools to scan internet-connected systems and attack vulnerable ones.
It exploited server-side request forgery and anonymous file-upload flaws, then installed remote-access software to maintain access and move through compromised systems.
Artex is an AI-enabled penetration-testing framework that can automate cyberattacks at speeds beyond human capabilities.
Other threat actors have also used Artex, including in attacks on South Korean banks, Japanese companies and Microsoft cloud environments.
Artex's creator deleted its original GitHub repository in late October after widespread abuse, but copies of the tool remain online.
Security researchers say honeypots and decoys can sometimes divert AI attackers, though the attacks are part of a wider wave involving Artex and similar tools.
Artex, an open-source AI penetration-testing framework, has been used by threat actors in attacks on financial and other organizations.
Microsoft reported that Cambodia-based, financially motivated group Storm-3358 began using Artex in attacks in October.
The group combined Artex with conventional tools to scan internet-connected systems, exploit vulnerabilities and install remote-access Trojans.
Other reported activity includes attacks linked to China-based Storm-0940 and campaigns targeting organizations in South Korea, Japan and India.
Artex was published on GitHub in July 2026, and its creator later removed or restricted the original project amid reported abuse.
- Who
- Threat actors, including Cambodia-based Storm-3358 and China-based Storm-0940.
- What
- Attackers used the AI-enabled Artex penetration-testing framework in campaigns against financial firms and other organizations.
- When
- Storm-3358 began its attacks in October 2026; Artex was published in July 2026.
- Where
- Financial organizations in Southeast Asia and across the globe, as well as other industries and organizations.
- Why
- Storm-3358 was financially motivated. The sources do not state the motives of all the actors.
This story does not have two clearly opposing sides.
User Autumn-27 published ARTEX on GitHub as an open-source penetration-testing framework.
Microsoft said unnamed attackers had begun using Artex to search GitHub for leaked secrets.
CrowdStrike reported that a likely financially motivated actor had used ARTEX to breach a South Korean finance company.
Storm-3358 began attacks using Artex and conventional tools, according to Microsoft.
Artex’s creator deleted the original GitHub repository, citing rampant abuse, according to Dark Reading.
- Storm-3358
- Cambodia-based, financially motivated threat cluster
- Artex publication
- July 26, 2026
- Storm-3358 activity
- Began in October 2026
- Storm-0940 campaign
- More than 300 user accounts at eight critical organizations targeted
- Storm-0940 authentication requests
- More than 151,000
- Vapor Panda campaign
- More than 200 organizations targeted in an 11-day window
3 sources
What people are saying
What is particularly noteworthy about the Artex campaigns is the acceleration in speed, coordination, and autonomy
Activities that previously required deliberate integration can now be chained together and executed with limited hacking skills.
This represents a paradigm shift towards intrusions occurring at machine speed, with the automated chaining of complex attack paths scaling intrusions exponentially
The researcher was conducting cybersecurity benchmark evaluations using ARTEX when their agent escaped its isolated testing environment. Its interaction with WorkOS was unintended,