Storm-3358: ARTEX AI Abuse and Cloud API Exploitation

Source

---
analysis: A single rule for API enumeration is prone to noise from developers; this
  hunt pivots from credential spray signals to API discovery, and finally to confirmed
  RDP movement and C2 traffic, providing the context an analyst needs to differentiate
  AI-driven attacks from normal operations.
blind_spots:
- id: limited-cloud-api-logging
  owner: Cloud Engineering
  question: Which specific resources were enumerated via API?
  remediation: Enable Data Events for sensitive S3 buckets and RDS instances.
  requires: Verbose CloudTrail or Entra ID Audit logging
  risk: If only management events are logged and not data events, the full extent
    of database dumping may be missed.
  stage: api-enumeration-and-cloud-abuse
- id: rdp-client-isolation
  owner: Identity Team
  question: Did the actor connect via an internal jump box?
  remediation: Ensure RDP gateway logs are integrated with sign-in telemetry.
  requires: hb_auth_signin with full src_endpoint_ip context
  risk: If the source IP is masked by a proxy or jump box, the true origin of the
    lateral movement is obscured.
  stage: lateral-movement-via-rdp
coverage:
- stage: credential-spraying-and-brute-force
  status: covered
  steps:
  - password-spray-detection
- stage: api-enumeration-and-cloud-abuse
  status: covered
  steps:
  - api-enumeration-discovery
- stage: lateral-movement-via-rdp
  status: covered
  steps:
  - rdp-lateral-movement
- stage: c2-and-exfiltration
  status: covered
  steps:
  - c2-exfiltration-traffic
- reason: Belongs to another part of the 'ARTEX abuse expands as cybercriminals target
    financial sector' series.
  stage: autonomous-vulnerability-scanning
  status: out_of_scope
- reason: Belongs to another part of the 'ARTEX abuse expands as cybercriminals target
    financial sector' series.
  stage: automated-payload-delivery
  status: out_of_scope
- reason: Belongs to another part of the 'ARTEX abuse expands as cybercriminals target
    financial sector' series.
  stage: persistence-via-webshells-and-rats
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Agentic AI frameworks like ARTEX operate at machine speed, making
    traditional detection rules brittle. This hunt identifies the behavioral markers
    of automated abuse across the identity and cloud planes, providing a high-confidence
    negative result over the estate.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An adversary is using an agentic AI framework to perform rapid-fire credential
  spraying and API enumeration, leading to lateral movement via RDP and data exfiltration
  from compromised cloud identities.
labels:
- hunt
- attack.t1110.003
- attack.t1110
- attack.t1059
- attack.t1021.001
- attack.t1078
- attack.t1071
- attack.t1041
- command and control
- credential access
- discovery
- execution
- initial access
- lateral movement
- persistence
name: 'Storm-3358: ARTEX AI Abuse and Cloud API Exploitation'
parameters:
  ioc_ips:
    default:
    - 199.19.95.66
    - 199.19.95.67
    - 199.19.95.68
    - 91.92.240.238
    - 85.11.168.45
    - 178.15.54.129
    - 31.77.229.35
    - 85.11.167.52
    - 178.16.54.129
    description: Observed ARTEX and WISP C2 nodes from the report.
    from:
      kind: article
      observed: '2026-11-06'
      ref: https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
    type: list[ip]
  lookback_days:
    default: '14'
    description: Days of historical data to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional list of hostnames to focus the lateral movement and exfiltration
      steps.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
    gates:
    - dry-run
    - lint
    - critic
    model: hb_google/gemini-3-flash-preview
rationale: The hunt focuses on web servers as the initial entry point and then expands
  to all identity and network logs. If internal RDP traffic is high, filter by source
  IPs identified in the password-spraying step.
references:
- name: "MSRC Blog \u2014 ARTEX abuse expands as cybercriminals target financial sector"
  url: https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
related:
- hunt: storm-3358-initial-access-and-persistence
  reason: This hunt focuses on post-compromise identity abuse; the sibling hunt covers
    the initial web exploitation and RAT delivery.
  relation: follows
scenario:
  stages:
  - name: Autonomous Vulnerability Scanning
    observables:
    - Nmap
    - headless Chromium
    - Playwright
    - Norma SDK WebFetch
    - SSRF
    - anonymous file upload
    - high-frequency requests
    slug: autonomous-vulnerability-scanning
    tactic: initial-access
    techniques:
    - T1190
  - name: Automated Payload Delivery
    observables:
    - curl
    - wget
    - netcat
    - Python HTTP clients
    - 199.19.95.66
    - 91.92.240.238
    slug: automated-payload-delivery
    tactic: execution
    techniques:
    - T1059
  - name: Persistence via Webshells and RATs
    observables:
    - WISP
    - vshell
    - AdaptixC2
    - web shells
    slug: persistence-via-webshells-and-rats
    tactic: persistence
    techniques:
    - T1505.003
  - name: Credential Spraying and Brute Force
    observables:
    - password spraying
    - brute-force login attempts
    - machine-speed sign-ins
    slug: credential-spraying-and-brute-force
    tactic: credential-access
    techniques:
    - T1110.003
    - T1110
  - name: API Enumeration and Cloud Abuse
    observables:
    - API enumeration
    - cloud identity abuse
    - database dumping
    slug: api-enumeration-and-cloud-abuse
    tactic: discovery
    techniques:
    - T1059
  - name: Lateral Movement via RDP
    observables:
    - RDP sessions
    - compromised cloud identities
    slug: lateral-movement-via-rdp
    tactic: lateral-movement
    techniques:
    - T1021.001
    - T1078
  - name: C2 and Exfiltration
    observables:
    - 199.19.95.66
    - 199.19.95.67
    - 199.19.95.68
    - 85.11.167.52
    - exfiltration over C2
    slug: c2-and-exfiltration
    tactic: command-and-control
    techniques:
    - T1071
    - T1041
  summary: Storm-3358, a Cambodia-based actor, uses the ARTEX agentic AI framework
    to automate web vulnerability scanning and exploitation (SSRF, file upload) at
    machine speed. The actor leverages common tools like curl and netcat to deploy
    open-source RATs (WISP, vshell) before pivoting to cloud identity abuse and RDP
    for lateral movement and exfiltration.
series:
  index: 2
  slug: artex-abuse-expands-as-cybercriminals-target-financial-sector
  title: ARTEX abuse expands as cybercriminals target financial sector
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  identity:
    category: identity
    name: Identity / sign-in telemetry
    telemetry:
    - identity
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
tlp: clear
type: investigation
---


# Storm-3358: ARTEX AI Abuse and Cloud API Exploitation

This hunt targets the identity and cloud-abuse phases of Storm-3358 activity. It identifies automated brute-force and password-spraying attempts against Entra ID and local resources, followed by high-velocity API discovery patterns characteristic of agentic AI frameworks like ARTEX. The hunt then pivots to find evidence of lateral movement via RDP using compromised accounts and matches outbound network traffic against known C2 infrastructure or unusual exfiltration volumes.

## scope-web-assets
<!-- Identify candidate web servers -->
Focus the hunt on hosts running common web server software that ARTEX targets for initial exploitation.

```sqlite target=endpoint role=scoping
~~~yaml
expected: A list of hostnames running web server software. This defines the primary
  attack surface.
reads:
- asset_scope
- device_hostname
- package_name
- package_version
silence: not_evidence_of_absence
source: hb_software_inventory
verified: dry-run
verified_at: '2026-11-07'
~~~
SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%httpd%' OR LOWER(package_name) LIKE '%iis%') AND (asset_scope = 'endpoint' OR asset_scope IS NULL)
```

## early-stage-activity
<!-- Hunt for automated access and discovery -->
parallel:
- → password-spray-detection
- → api-enumeration-discovery
join: → triage-initial-access

## password-spray-detection
<!-- High-volume credential spray -->
Detect sources attempting to authenticate against multiple accounts in a short window.

```sqlite target=identity role=baseline params=(lookback_days=lookback_days)
~~~yaml
baseline:
  compare: new_this_window
  window: '{{lookback_days}}d'
expected: IP addresses attempting to log in as many different users. Genuine sprays
  often exceed 10 users per IP.
prevalence:
  by: actor_user_name
  key:
  - src_endpoint_ip
  rare_below: 2
reads:
- actor_user_name
- src_endpoint_ip
- status_id
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-11-07'
~~~
SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS user_count, COUNT(*) AS attempts, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE status_id = 2 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING user_count > 5 ORDER BY user_count DESC
```

## api-enumeration-discovery
<!-- Agentic API enumeration -->
Detect machine-speed API discovery typical of frameworks like ARTEX.

```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days)
~~~yaml
expected: Single principals executing a wide variety of API operations in a single
  service, indicating discovery of environment resources.
reads:
- actor_user_name
- api_operation
- api_service_name
- src_endpoint_ip
- time
silence: not_evidence_of_absence
source: hb_cloud_api_activity
verified: dry-run
verified_at: '2026-11-07'
~~~
SELECT actor_user_name, src_endpoint_ip, api_service_name, COUNT(DISTINCT api_operation) AS unique_ops, COUNT(*) AS call_count FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, api_service_name HAVING unique_ops > 10 AND call_count > 50 ORDER BY unique_ops DESC
```

## triage-initial-access
<!-- Triage initial access attempts -->
```agent target=hunter
cite: required
context:
- password-spray-detection
- api-enumeration-discovery
max_iterations: 3
objective: Determine which source IPs or users are performing automated discovery
  or credential abuse indicative of ARTEX usage.
success_criteria: A list of high-risk principals and source IPs with cited automated
  behavior.
tools:
- endpoint
- identity
- network
```

## follow-on-activity
<!-- Hunt for movement and exfiltration -->
parallel:
- → rdp-lateral-movement
- → c2-exfiltration-traffic
join: → triage-intrusion

## rdp-lateral-movement
<!-- Lateral movement via RDP -->
Find successful RDP sessions targeting the scoped hosts or using compromised credentials.

```sqlite target=identity role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts)
~~~yaml
expected: RDP logons involving users identified in the previous triage or originating
  from suspicious internal/external IPs.
reads:
- actor_user_name
- dst_endpoint_hostname
- logon_type
- src_endpoint_ip
- status_id
- time
silence: not_evidence_of_absence
source: hb_auth_signin
verified: dry-run
verified_at: '2026-11-07'
~~~
SELECT dst_endpoint_hostname, actor_user_name, src_endpoint_ip, logon_type, time FROM hb_auth_signin WHERE logon_type = 'Remote Interactive' AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC
```

## c2-exfiltration-traffic
<!-- C2 and exfiltration traffic -->
Identify traffic to known Storm-3358 infrastructure or large outbound data transfers.

```sqlite target=network role=triage params=(lookback_days=lookback_days, ioc_ips=ioc_ips)
~~~yaml
expected: Connections to specific ARTEX or WISP C2 nodes, or high-volume transfers
  to any destination.
reads:
- device_hostname
- direction
- dst_endpoint_ip
- dst_endpoint_port
- time
- traffic_bytes
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-11-07'
~~~
SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, SUM(traffic_bytes) AS total_outbound, COUNT(*) AS connection_count FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR traffic_bytes > 50000000) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port ORDER BY total_outbound DESC
```

## triage-intrusion
<!-- Correlate intrusion lifecycle -->
```agent target=hunter
cite: required
context:
- triage-initial-access
- rdp-lateral-movement
- c2-exfiltration-traffic
max_iterations: 5
objective: Verify if the initial access indicators from the first agent led to successful
  lateral movement or data exfiltration on the identified hosts.
success_criteria: A per-host verdict linking the automated discovery to specific malicious
  actions.
tools:
- endpoint
- identity
- network
```

## route-verdict
<!-- Route on verdict -->
if~: "The triage-intrusion verdict is malicious for any host or user principal." (confidence: high, judge=hunter)
then: → contain-threat
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: limited-cloud-api-logging)
else: → close-out

## contain-threat
<!-- Revoke and isolate -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the identified endpoints and revoke credentials for the compromised user accounts in Entra ID.
```
→ analyst-review

## analyst-review
<!-- Full incident review -->
```manual target=analyst
Review the cited logs for the confirmed malicious activity. Identify any additional API operations or database dumps not captured in the summary queries.
```
→ close-out

## close-out
<!-- Close out hunt -->
```manual target=analyst
Log the IPs and users for future monitoring and refine the API enumeration threshold based on normal administrative activity in the environment.
```
→ end