DECLARED: Storm-3358/ARTEX operation (Microsoft Threat Intelligence, 6 Nov) admitted 9 Nov as a candidate second operation; held for blind reproduction; counting decision at the Issue 47 cutoff
- id
- RA-2026-046-03
- date
- 2026-11-09
- issue
- Issue No. 46
- condition
- SC-2026-008
- action
- DECLARED: Storm-3358/ARTEX operation (Microsoft Threat Intelligence, 6 Nov) admitted 9 Nov as a candidate second operation; held for blind reproduction; counting decision at the Issue 47 cutoff
- from
- CONFIRMED (grandfathered) / Stable; one counted operation; Storm-0940 candidate held (RA-2026-045-01)
- to
- CONFIRMED (grandfathered) / Stable; one counted operation; two ARTEX candidates held, one declared this issue
- outlook
- Stable
- watch
- none
- criterion version
- SC-2026-008 scope v1.2
- methodology version
- v1.3
- evidence rows
- SN-2026-11-09-01
- grades
- Telemetry elements Grade A (Microsoft first-hand; real third-party financial-sector targets; remote-access tools installed); agency element unestablished on the source text (degree of operator direction not stated); no exploitation date recorded, the campaign is dated to October only (CHQ-CORR-2026-035)
- independence determination
- Operator and victims distinct from the founding operation and from Storm-0940; framework shared with Storm-0940 (open-source ARTEX). Whether two operators on one framework are independent operations for counting is referred to the audit
- rule applied
- STAB clause 1 (settling issue: declared this issue, decided next after blind reproduction); scope v1.2 verbatim; CGS-3.1/3.2 on the agency proposition
- alternative not taken
- Decide at this cutoff on the Storm-0940 precedent, which would return indeterminate on the same element (not taken: the reproduction has not run, and the record does not count or reject a candidate on an expected verdict)
- blind reproduction
- OWED before 2026-11-16: context-free instance, frozen scope v1.2 verbatim, source pointer, no CHQ routing disclosed; packet to carry the 5 Nov Microsoft post and the 8 Nov VulnCheck post as enrichment only
- reproduction result
- not yet run
- cgs provisions
- CGS-2.2, CGS-3.1, CGS-3.2, CGS-6.2
- record links
- CHQ-RAT-2026-046; CHQ-CORR-2026-035; the signal ledger SN-2026-11-09-01
- status
- VALID
- admission status
- Declared, not decided. Admitted 9 November 2026 as a candidate second operation and held for blind reproduction; counting decision at the Issue 47 cutoff.