Agentic AI Attack Tools Are Hitting Finance Faster. Layered Defenses Still Beat Any Single Product
Microsoft says Storm-3358 is using the ARTEX agentic offensive framework against financial organizations. The lesson for everyone else is the same: identity, endpoint, deception and logging have to work together.
When attack agents move at machine speed, one control is not a strategy
Attackers are no longer only writing scripts by hand. Microsoft Threat Intelligence reports that a financially motivated cluster it tracks as Storm-3358 used the agentic AI offensive framework ARTEX in October 2026 against financial organizations—mostly in Southeast Asia, with some larger firms elsewhere.
The picture below draws on the Microsoft Security Blog post on ARTEX abuse in the financial sector and related Microsoft research on agentic tooling used to find and abuse exposed secrets. Product names appear only as examples of control types; the checklist that follows is vendor-neutral.
What Microsoft says the agents are doing
- Scanning internet-facing systems, often paired with conventional automation.
- Exploiting flaws such as anonymous file upload and server-side request forgery (SSRF).
- Installing open-source remote access tools (Microsoft cites WISP, vshell and AdaptixC2) for persistence and lateral movement, sometimes pulled down with utilities such as netcat and curl.
- Using web shells on compromised web servers, harvesting credentials from public sources and compromised systems, and abusing cloud identities for persistence and data theft.
- Brute-force and password-spray attempts, API enumeration and abuse, and database dumping—at machine speed once a foothold exists.
Signals that an agent, not a human, is probing you
Microsoft notes agentic frameworks tend to fire a wide mix of requests in a short window, retry variations quickly, and lean on stock penetration-testing tooling (Nmap, curl, wget, Python HTTP clients, headless browsers and similar). Default user-agent strings and tool fingerprints can tip defenders off even when blocking them only buys minutes—agents change those details fast. Proxies and VPNs still hide source IPs, so detections have to look at behavior, not only blocklists.
A seven-item layered-defense checklist
- Close the obvious internet doors. Inventory public web apps and APIs; fix anonymous upload, SSRF and other cheap initial-access bugs before an agent finds them.
- Treat secrets as short-lived. Rotate long-lived API tokens and hard-coded credentials; scan public repos and CI logs for leaks agents love to harvest.
- Put risk on every sign-in. Require phishing-resistant MFA where you can, and step up or block when sign-in risk is high—identity controls catch stolen cloud sessions that a firewall never sees.
- Watch endpoints for living-off-the-land downloads. Alert on unusual use of curl/netcat-style fetchers and new remote-access binaries on servers that should not install them.
- Segment and least-privilege sideways movement. Assume a web shell on one host should not become domain-wide access; limit service accounts and east-west paths.
- Add deception where it fits. Honeypots, decoys, tarpits and convincing “fake wins” can waste an autonomous agent’s time and budget and produce high-confidence signal.
- Hunt on volume and velocity. Machine-speed retries leave noisy timelines; give analysts (and your MDR partner) queries that look for bursty exploit attempts across many URLs in minutes.
What this means for your company
You do not need to be a Southeast Asian bank to care. Agentic frameworks lower the cost of scanning, exploiting and moving laterally against whoever left an upload form or a long-lived token exposed. Buying one more product will not outrun that. Layered defenses—identity, patching, endpoint visibility, network segmentation, deception and practiced response—still decide whether an automated probe becomes a breach. Map those layers to your real apps and cloud tenants, and test them against a noisy, fast scan—not only against last year’s phishing email.
Want a vendor-neutral review of how your identity, endpoint and internet-facing apps would hold up against automated attack agents? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
