{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Agentic AI frameworks like ARTEX operate at machine speed, making traditional detection rules brittle. This hunt identifies the behavioral markers of automated abuse across the identity and cloud planes, providing a high-confidence negative result over the estate." }, "name": "Storm-3358: ARTEX AI Abuse and Cloud API Exploitation", "type": "investigation", "labels": [ "hunt", "attack.t1110.003", "attack.t1110", "attack.t1059", "attack.t1021.001", "attack.t1078", "attack.t1071", "attack.t1041", "command and control", "credential access", "discovery", "execution", "initial access", "lateral movement", "persistence" ], "series": { "slug": "artex-abuse-expands-as-cybercriminals-target-financial-sector", "index": 2, "title": "ARTEX abuse expands as cybercriminals target financial sector", "total": 2 }, "related": [ { "hunt": "storm-3358-initial-access-and-persistence", "reason": "This hunt focuses on post-compromise identity abuse; the sibling hunt covers the initial web exploitation and RAT delivery.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A single rule for API enumeration is prone to noise from developers; this hunt pivots from credential spray signals to API discovery, and finally to confirmed RDP movement and C2 traffic, providing the context an analyst needs to differentiate AI-driven attacks from normal operations.", "coverage": [ { "stage": "credential-spraying-and-brute-force", "steps": [ "password-spray-detection" ], "status": "covered" }, { "stage": "api-enumeration-and-cloud-abuse", "steps": [ "api-enumeration-discovery" ], "status": "covered" }, { "stage": "lateral-movement-via-rdp", "steps": [ "rdp-lateral-movement" ], "status": "covered" }, { "stage": "c2-and-exfiltration", "steps": [ "c2-exfiltration-traffic" ], "status": "covered" }, { "stage": "autonomous-vulnerability-scanning", "reason": "Belongs to another part of the 'ARTEX abuse expands as cybercriminals target financial sector' series.", "status": "out_of_scope" }, { "stage": "automated-payload-delivery", "reason": "Belongs to another part of the 'ARTEX abuse expands as cybercriminals target financial sector' series.", "status": "out_of_scope" }, { "stage": "persistence-via-webshells-and-rats", "reason": "Belongs to another part of the 'ARTEX abuse expands as cybercriminals target financial sector' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Autonomous Vulnerability Scanning", "slug": "autonomous-vulnerability-scanning", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Nmap", "headless Chromium", "Playwright", "Norma SDK WebFetch", "SSRF", "anonymous file upload", "high-frequency requests" ] }, { "name": "Automated Payload Delivery", "slug": "automated-payload-delivery", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "curl", "wget", "netcat", "Python HTTP clients", "199.19.95.66", "91.92.240.238" ] }, { "name": "Persistence via Webshells and RATs", "slug": "persistence-via-webshells-and-rats", "tactic": "persistence", "techniques": [ "T1505.003" ], "observables": [ "WISP", "vshell", "AdaptixC2", "web shells" ] }, { "name": "Credential Spraying and Brute Force", "slug": "credential-spraying-and-brute-force", "tactic": "credential-access", "techniques": [ "T1110.003", "T1110" ], "observables": [ "password spraying", "brute-force login attempts", "machine-speed sign-ins" ] }, { "name": "API Enumeration and Cloud Abuse", "slug": "api-enumeration-and-cloud-abuse", "tactic": "discovery", "techniques": [ "T1059" ], "observables": [ "API enumeration", "cloud identity abuse", "database dumping" ] }, { "name": "Lateral Movement via RDP", "slug": "lateral-movement-via-rdp", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1078" ], "observables": [ "RDP sessions", "compromised cloud identities" ] }, { "name": "C2 and Exfiltration", "slug": "c2-and-exfiltration", "tactic": "command-and-control", "techniques": [ "T1071", "T1041" ], "observables": [ "199.19.95.66", "199.19.95.67", "199.19.95.68", "85.11.167.52", "exfiltration over C2" ] } ], "summary": "Storm-3358, a Cambodia-based actor, uses the ARTEX agentic AI framework to automate web vulnerability scanning and exploitation (SSRF, file upload) at machine speed. The actor leverages common tools like curl and netcat to deploy open-source RATs (WISP, vshell) before pivoting to cloud identity abuse and RDP for lateral movement and exfiltration." }, "severity": "high", "rationale": "The hunt focuses on web servers as the initial entry point and then expands to all identity and network logs. If internal RDP traffic is high, filter by source IPs identified in the password-spraying step.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using an agentic AI framework to perform rapid-fire credential spraying and API enumeration, leading to lateral movement via RDP and data exfiltration from compromised cloud identities.", "parameters": { "ioc_ips": { "from": { "ref": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "kind": "article", "observed": "2026-11-06" }, "type": "list[ip]", "default": [ "199.19.95.66", "199.19.95.67", "199.19.95.68", "91.92.240.238", "85.11.168.45", "178.15.54.129", "31.77.229.35", "85.11.167.52", "178.16.54.129" ], "description": "Observed ARTEX and WISP C2 nodes from the report." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the lateral movement and exfiltration steps." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of historical data to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/", "name": "MSRC Blog \u2014 ARTEX abuse expands as cybercriminals target financial sector" } ], "blind_spots": [ { "id": "limited-cloud-api-logging", "risk": "If only management events are logged and not data events, the full extent of database dumping may be missed.", "owner": "Cloud Engineering", "stage": "api-enumeration-and-cloud-abuse", "question": "Which specific resources were enumerated via API?", "requires": "Verbose CloudTrail or Entra ID Audit logging", "remediation": "Enable Data Events for sensitive S3 buckets and RDS instances." }, { "id": "rdp-client-isolation", "risk": "If the source IP is masked by a proxy or jump box, the true origin of the lateral movement is obscured.", "owner": "Identity Team", "stage": "lateral-movement-via-rdp", "question": "Did the actor connect via an internal jump box?", "requires": "hb_auth_signin with full src_endpoint_ip context", "remediation": "Ensure RDP gateway logs are integrated with sign-in telemetry." } ] }, "name": "Storm-3358: ARTEX AI Abuse and Cloud API Exploitation", "description": "This hunt targets the identity and cloud-abuse phases of Storm-3358 activity. It identifies automated brute-force and password-spraying attempts against Entra ID and local resources, followed by high-velocity API discovery patterns characteristic of agentic AI frameworks like ARTEX. The hunt then pivots to find evidence of lateral movement via RDP using compromised accounts and matches outbound network traffic against known C2 infrastructure or unusual exfiltration volumes." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "artex-abuse-expands-as-cybercriminals-target-financial-sector", "index": 2, "title": "ARTEX abuse expands as cybercriminals target financial sector", "total": 2 }, "coverage": [ { "stage": "credential-spraying-and-brute-force", "steps": [ "password-spray-detection" ], "status": "covered" }, { "stage": "api-enumeration-and-cloud-abuse", "steps": [ "api-enumeration-discovery" ], "status": "covered" }, { "stage": "lateral-movement-via-rdp", "steps": [ "rdp-lateral-movement" ], "status": "covered" }, { "stage": "c2-and-exfiltration", "steps": [ "c2-exfiltration-traffic" ], "status": "covered" }, { "stage": "autonomous-vulnerability-scanning", "reason": "Belongs to another part of the 'ARTEX abuse expands as cybercriminals target financial sector' series.", "status": "out_of_scope" }, { "stage": "automated-payload-delivery", "reason": "Belongs to another part of the 'ARTEX abuse expands as cybercriminals target financial sector' series.", "status": "out_of_scope" }, { "stage": "persistence-via-webshells-and-rats", "reason": "Belongs to another part of the 'ARTEX abuse expands as cybercriminals target financial sector' series.", "status": "out_of_scope" } ], "rationale": "An adversary is using an agentic AI framework to perform rapid-fire credential spraying and API enumeration, leading to lateral movement via RDP and data exfiltration from compromised cloud identities.", "blind_spots": [ { "id": "limited-cloud-api-logging", "risk": "If only management events are logged and not data events, the full extent of database dumping may be missed.", "owner": "Cloud Engineering", "stage": "api-enumeration-and-cloud-abuse", "question": "Which specific resources were enumerated via API?", "requires": "Verbose CloudTrail or Entra ID Audit logging", "remediation": "Enable Data Events for sensitive S3 buckets and RDS instances." }, { "id": "rdp-client-isolation", "risk": "If the source IP is masked by a proxy or jump box, the true origin of the lateral movement is obscured.", "owner": "Identity Team", "stage": "lateral-movement-via-rdp", "question": "Did the actor connect via an internal jump box?", "requires": "hb_auth_signin with full src_endpoint_ip context", "remediation": "Ensure RDP gateway logs are integrated with sign-in telemetry." } ], "scoping_notes": "The hunt focuses on web servers as the initial entry point and then expands to all identity and network logs. If internal RDP traffic is high, filter by source IPs identified in the password-spraying step.", "beyond_detection": "A single rule for API enumeration is prone to noise from developers; this hunt pivots from credential spray signals to API discovery, and finally to confirmed RDP movement and C2 traffic, providing the context an analyst needs to differentiate AI-driven attacks from normal operations." } }, { "id": "scope-web-assets", "type": "query", "label": "Identify candidate web servers", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%httpd%' OR LOWER(package_name) LIKE '%iis%') AND (asset_scope = 'endpoint' OR asset_scope IS NULL)", "surface": "hb_software_inventory", "description": "Focus the hunt on hosts running common web server software that ARTEX targets for initial exploitation.", "expected_signal": "A list of hostnames running web server software. This defines the primary attack surface." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify candidate web servers", "reads": [ "asset_scope", "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%httpd%' OR LOWER(package_name) LIKE '%iis%') AND (asset_scope = 'endpoint' OR asset_scope IS NULL)", "silence": "not_evidence_of_absence", "expected": "A list of hostnames running web server software. This defines the primary attack surface.", "verified": "dry-run", "verified_at": "2026-11-07" } }, { "id": "password-spray-detection", "type": "query", "label": "High-volume credential spray", "config": { "dsl": "sqlite", "role": "baseline", "source": "identity", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS user_count, COUNT(*) AS attempts, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE status_id = 2 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING user_count > 5 ORDER BY user_count DESC", "surface": "hb_auth_signin", "description": "Detect sources attempting to authenticate against multiple accounts in a short window.", "expected_signal": "IP addresses attempting to log in as many different users. Genuine sprays often exceed 10 users per IP." }, "parents": [ { "id": "scope-web-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "High-volume credential spray", "reads": [ "actor_user_name", "src_endpoint_ip", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT src_endpoint_ip, COUNT(DISTINCT actor_user_name) AS user_count, COUNT(*) AS attempts, MIN(time) AS first_attempt, MAX(time) AS last_attempt FROM hb_auth_signin WHERE status_id = 2 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING user_count > 5 ORDER BY user_count DESC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "new_this_window" }, "expected": "IP addresses attempting to log in as many different users. Genuine sprays often exceed 10 users per IP.", "verified": "dry-run", "prevalence": { "by": "actor_user_name", "key": [ "src_endpoint_ip" ], "rare_below": 2 }, "verified_at": "2026-11-07" } }, { "id": "api-enumeration-discovery", "type": "query", "label": "Agentic API enumeration", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT actor_user_name, src_endpoint_ip, api_service_name, COUNT(DISTINCT api_operation) AS unique_ops, COUNT(*) AS call_count FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, api_service_name HAVING unique_ops > 10 AND call_count > 50 ORDER BY unique_ops DESC", "surface": "hb_cloud_api_activity", "description": "Detect machine-speed API discovery typical of frameworks like ARTEX.", "expected_signal": "Single principals executing a wide variety of API operations in a single service, indicating discovery of environment resources." }, "parents": [ { "id": "scope-web-assets" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Agentic API enumeration", "reads": [ "actor_user_name", "api_operation", "api_service_name", "src_endpoint_ip", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT actor_user_name, src_endpoint_ip, api_service_name, COUNT(DISTINCT api_operation) AS unique_ops, COUNT(*) AS call_count FROM hb_cloud_api_activity WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip, api_service_name HAVING unique_ops > 10 AND call_count > 50 ORDER BY unique_ops DESC", "silence": "not_evidence_of_absence", "expected": "Single principals executing a wide variety of API operations in a single service, indicating discovery of environment resources.", "verified": "dry-run", "verified_at": "2026-11-07" } }, { "id": "triage-initial-access", "type": "analytic", "label": "Triage initial access attempts", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network" ], "context": [ "password-spray-detection", "api-enumeration-discovery" ], "objective": "Determine which source IPs or users are performing automated discovery or credential abuse indicative of ARTEX usage.", "description": "Identify specific users or source IPs that are highly likely to be ARTEX agents.", "max_iterations": 3, "expected_signal": "A list of compromised or high-risk accounts and IPs.", "success_criteria": "A list of high-risk principals and source IPs with cited automated behavior." }, "parents": [ { "id": "password-spray-detection", "kind": "merge" }, { "id": "api-enumeration-discovery", "kind": "merge" } ] }, { "id": "rdp-lateral-movement", "type": "query", "label": "Lateral movement via RDP", "config": { "dsl": "sqlite", "role": "enrichment", "source": "identity", "content": "SELECT dst_endpoint_hostname, actor_user_name, src_endpoint_ip, logon_type, time FROM hb_auth_signin WHERE logon_type = 'Remote Interactive' AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "surface": "hb_auth_signin", "description": "Find successful RDP sessions targeting the scoped hosts or using compromised credentials.", "expected_signal": "RDP logons involving users identified in the previous triage or originating from suspicious internal/external IPs." }, "parents": [ { "id": "triage-initial-access" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Lateral movement via RDP", "reads": [ "actor_user_name", "dst_endpoint_hostname", "logon_type", "src_endpoint_ip", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT dst_endpoint_hostname, actor_user_name, src_endpoint_ip, logon_type, time FROM hb_auth_signin WHERE logon_type = 'Remote Interactive' AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "silence": "not_evidence_of_absence", "expected": "RDP logons involving users identified in the previous triage or originating from suspicious internal/external IPs.", "verified": "dry-run", "verified_at": "2026-11-07" } }, { "id": "c2-exfiltration-traffic", "type": "query", "label": "C2 and exfiltration traffic", "config": { "dsl": "sqlite", "role": "triage", "source": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, SUM(traffic_bytes) AS total_outbound, COUNT(*) AS connection_count FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR traffic_bytes > 50000000) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port ORDER BY total_outbound DESC", "surface": "hb_network_connection", "description": "Identify traffic to known Storm-3358 infrastructure or large outbound data transfers.", "expected_signal": "Connections to specific ARTEX or WISP C2 nodes, or high-volume transfers to any destination." }, "parents": [ { "id": "triage-initial-access" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "C2 and exfiltration traffic", "reads": [ "device_hostname", "direction", "dst_endpoint_ip", "dst_endpoint_port", "time", "traffic_bytes" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_ip, dst_endpoint_port, SUM(traffic_bytes) AS total_outbound, COUNT(*) AS connection_count FROM hb_network_connection WHERE direction = 'outbound' AND (instr(',' || '{{ioc_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 OR traffic_bytes > 50000000) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip, dst_endpoint_port ORDER BY total_outbound DESC", "silence": "not_evidence_of_absence", "expected": "Connections to specific ARTEX or WISP C2 nodes, or high-volume transfers to any destination.", "verified": "dry-run", "verified_at": "2026-11-07" } }, { "id": "triage-intrusion", "type": "analytic", "label": "Correlate intrusion lifecycle", "config": { "cite": "required", "tools": [ "endpoint", "identity", "network" ], "context": [ "triage-initial-access", "rdp-lateral-movement", "c2-exfiltration-traffic" ], "objective": "Verify if the initial access indicators from the first agent led to successful lateral movement or data exfiltration on the identified hosts.", "description": "Establish the link between initial discovery and follow-on lateral movement or exfiltration.", "max_iterations": 5, "expected_signal": "A confirmed path from high-risk API/auth behavior to data exfiltration.", "success_criteria": "A per-host verdict linking the automated discovery to specific malicious actions." }, "parents": [ { "id": "rdp-lateral-movement", "kind": "merge" }, { "id": "c2-exfiltration-traffic", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "The triage-intrusion verdict is malicious for any host or user principal.", "condition": "The triage-intrusion verdict is malicious for any host or user principal.", "blind_spot": "limited-cloud-api-logging", "confidence": "high", "description": "Decide whether to proceed with containment based on the agent's correlation.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-intrusion" } ] }, { "id": "contain-threat", "type": "action", "label": "Revoke and isolate", "config": { "target": "endpoint", "description": "Immediately stop the actor's ability to move laterally or exfiltrate data.", "instructions": "Isolate the identified endpoints and revoke credentials for the compromised user accounts in Entra ID.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Full incident review", "config": { "assignee": "analyst", "description": "Verify the findings and prepare for follow-on remediation.", "instructions": "Review the cited logs for the confirmed malicious activity. Identify any additional API operations or database dumps not captured in the summary queries." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "contain-threat" } ] }, { "id": "close-out", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document findings and tune future detections.", "instructions": "Log the IPs and users for future monitoring and refine the API enumeration threshold based on normal administrative activity in the environment." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }