A group of cybercriminals operating out of Cambodia has begun using the autonomous hacking framework ARTEX to target financial institutions worldwide, Microsoft reported. The group has used the tool since October to identify and exploit web-app vulnerabilities, including open file upload flaws, to install web shells and remote-access malware on the networks of large global banks and firms in Southeast Asia.
The agentic AI tool, which is open source and allows for rapid reconnaissance, was previously used by China state-aligned actors to automate large-scale intrusions. Microsoft tied the threat actor Storm-0940 to a supply chain attack on ConnectWise that allowed the group to target more than 2,250 Microsoft 365 tenants, executing up to 2,900 sign-in attempts per minute. While the framework is designed for penetration testing, security researchers have identified more than 2,000 servers running the software and warned that some distributed builds contain backdoors.
