Censys exposure research published November 5, 2026; Microsoft Storm-3358 report November 6, 2026; coverage November 6 to 7, 2026
The Attack Tool Was Left Open Too: 1,465 ARTEX Consoles Exposed as Microsoft Ties the Framework to Finance Attacks
Two reports in two days describe the same framework from opposite ends. On November 5, Censys reported 1,465 internet-facing hosts running an exposed ARTEX console, the open source autonomous penetration testing framework released in July 2026; about 650 of those hosts sit in two identically configured hosting blocks, leaving roughly 815 distinct-looking deployments, and the console does not need to be reachable from the public internet, so the exposure is a misconfiguration, not a requirement. On 155 hosts, 10.6 percent, Censys also detected other threat tooling, and 32 hosts exposed open directories holding implants, stagers and post-exploitation kits, in one case an operator home folder including SSH material and shell history. Censys is careful about what the count means: it is exposed deployments, not attackers, and some consoles belong to authorized testers. On November 6, Microsoft Threat Intelligence supplied the use case that gives the count its weight: Storm-3358, a Cambodia-based financially motivated cluster, began using ARTEX against financial organizations in October, mainly in Southeast Asia with some large organizations elsewhere also targeted, combining the agents with conventional scanners to exploit anonymous file upload and server-side request forgery flaws, install the WISP, vshell and AdaptixC2 remote access tools and web shells, and move with compromised credentials and cloud identities toward exfiltration. Microsoft published no sector-wide victim count or loss figure, and Storm-3358 is a separate cluster from Storm-0940, which Microsoft tied to ARTEX in the ConnectWise compromise in October; shared tooling alone does not merge them. ARTEX has announced a move to closed source, while dozens of code copies remain available on sharing sites, so neither the exposed consoles nor the framework itself is going away on any schedule defenders control.
Executives
Two facts belong in the same briefing. Attack automation built on AI agents is now in the hands of a financially motivated crew working the finance sector at machine speed, and hundreds of copies of that tooling sit open on the internet where anyone, including your own testers if they run it carelessly, can reach them. Ask whether your organization runs ARTEX or any similar agent framework anywhere, under whose authorization, and whether any console is reachable from the internet; then ask the defensive version of the same question, whether your detection assumes a human pace of attack that this reporting says no longer holds.
CIO / CISO
Separate the two actions the reports support. For exposure: sweep your own estate and your test ranges for agent consoles and open directories, because the Censys method, a console title and framework assets, is easy to replicate internally, and an exposed offensive tool is both a compromise risk and an attribution gift to anyone who finds it. For defense in finance and adjacent sectors: prioritize the unglamorous entry points Microsoft names, anonymous file upload and SSRF in internet-facing applications, plus credential and cloud identity hygiene, and use Microsoft hunting guidance while keeping Storm-3358 distinct from Storm-0940 in your intelligence records.
Engineers
Build detections around behavior, not around the brand name. ARTEX agents drive familiar tools, Nmap, curl, wget and headless browsers, in rapid and varied request patterns against public applications, and the follow-on artifacts are familiar too: web shells, WISP, vshell or AdaptixC2, and new cloud identity use at odd speed. Check your own ranges for the console signatures Censys used and for the neighboring exposures it recommends reviewing, open directories, tunneling services and unfamiliar LLM gateways, and treat short-lived directories as evidence worth capturing quickly, since ten closed and fifteen opened elsewhere in a two-day window in the Censys observation.
Everyone (non-IT)
The plain version: a powerful automated testing tool, built to find weaknesses, is being used by criminals against banks and similar firms, and hundreds of copies of the tool itself were left unlocked on the internet, in some cases with the operators own files visible. Nothing here changes what you should do as a customer; it explains why your bank may ask for stronger sign-in checks, and why security teams increasingly talk about attacks that move in minutes rather than days.