# DECLARED: Storm-3358/ARTEX operation (Microsoft Threat Intelligence, 6 Nov) admitted 9 Nov as a candidate second operation; held for blind reproduction; counting decision at the Issue 47 cutoff

- **Artifact ID:** RA-2026-046-03
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-046-03
- **Machine-record SHA-256:** `91bc7a4a01a39dd53f236afe2563d46342219622980ec2a55cbaeed87644152a`

## Complete structured record

```json
{
  "id": "RA-2026-046-03",
  "date": "2026-11-09",
  "issue": "Issue No. 46",
  "condition": "SC-2026-008",
  "action": "DECLARED: Storm-3358/ARTEX operation (Microsoft Threat Intelligence, 6 Nov) admitted 9 Nov as a candidate second operation; held for blind reproduction; counting decision at the Issue 47 cutoff",
  "from": "CONFIRMED (grandfathered) / Stable; one counted operation; Storm-0940 candidate held (RA-2026-045-01)",
  "to": "CONFIRMED (grandfathered) / Stable; one counted operation; two ARTEX candidates held, one declared this issue",
  "outlook": "Stable",
  "watch": "none",
  "criterion_version": "SC-2026-008 scope v1.2",
  "methodology_version": "v1.3",
  "evidence_rows": [
    "SN-2026-11-09-01"
  ],
  "grades": "Telemetry elements Grade A (Microsoft first-hand; real third-party financial-sector targets; remote-access tools installed); agency element unestablished on the source text (degree of operator direction not stated); no exploitation date recorded, the campaign is dated to October only (CHQ-CORR-2026-035)",
  "independence_determination": "Operator and victims distinct from the founding operation and from Storm-0940; framework shared with Storm-0940 (open-source ARTEX). Whether two operators on one framework are independent operations for counting is referred to the audit",
  "rule_applied": "STAB clause 1 (settling issue: declared this issue, decided next after blind reproduction); scope v1.2 verbatim; CGS-3.1/3.2 on the agency proposition",
  "alternative_not_taken": "Decide at this cutoff on the Storm-0940 precedent, which would return indeterminate on the same element (not taken: the reproduction has not run, and the record does not count or reject a candidate on an expected verdict)",
  "blind_reproduction": "OWED before 2026-11-16: context-free instance, frozen scope v1.2 verbatim, source pointer, no CHQ routing disclosed; packet to carry the 5 Nov Microsoft post and the 8 Nov VulnCheck post as enrichment only",
  "reproduction_result": "not yet run",
  "cgs_provisions": "CGS-2.2, CGS-3.1, CGS-3.2, CGS-6.2",
  "record_links": "CHQ-RAT-2026-046; CHQ-CORR-2026-035; the signal ledger SN-2026-11-09-01",
  "status": "VALID",
  "admission_status": "Declared, not decided. Admitted 9 November 2026 as a candidate second operation and held for blind reproduction; counting decision at the Issue 47 cutoff."
}
```