Cambodia

The cyber threat landscape in Cambodia during this period saw the active use of advanced offensive frameworks by financially motivated actors. The Cambodia-based threat actor Storm-3358 was reported on November 7, 2026, to be utilizing the agentic AI offensive framework ARTEX to target financial organizations primarily in Southeast Asia, as well as some global institutions. This group combines ARTEX with automated tools to scan systems, exploit vulnerabilities such as anonymous file upload and server-side request forgery, and deploy open-source remote access trojans including WISP, vshell, and AdaptixC2. The use of ARTEX enables rapid credential compromise, web shell deployment, lateral movement, privilege escalation, and data exfiltration, significantly increasing the speed and scale of attacks. This activity aligns with the "Nov 2026 Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns" incident on record.

In response to the pervasive issue of online scams, the Cambodian government continued its crackdown, reporting actions against 972 locations and the detention of 5,032 suspects between July 2025 and October 2026. However, these efforts face evolving challenges as criminal networks adopt sophisticated tactics, moving from large, centralized compounds to smaller, dispersed operations to evade detection. On November 6, 2026, the United States imposed sanctions on four individuals and 41 companies linked to the Prince Group, a Cambodia-based firm accused of running a billion-dollar cyberscam operation that defrauded Americans of over $400,000. This highlights the persistent nature of cyber-enabled financial crime originating from or operating within Cambodia.

Background: Other known state-sponsored threat actors that have historically targeted Cambodia include APT40, Naikon, Aoqin Dragon, and RANCOR, all of which are China-linked.