Wisp C2 and AdaptixC2 MCP consoles of the Storm-3358 intrusions against financial organisations

The main hunting rule keys on the Wisp console's own code (its API routes, element ids and the bridge of the injected tab), which survives a change of title or address. The AdaptixC2 MCP console is matched by a second hunting rule; AdaptixC2 itself is a public framework, so a match on that rule alone can also be a red team's server. Known servers as of 2026-11-07: 199.19.95[.]66, .67 and .68 (Wisp on ports 443, 8099 and 8100, AdaptixC2 on port 80), and 213.111.150[.]145 with the domain jinglewunn[.]com, which the injected tab names as its default server and which also offered Ghostscript and ImageTragick exploit test files that call back to a webhook. Microsoft lists 31.77.229[.]35, 85.11.168[.]45 and 178.16.54[.]129 as ARTEX servers and 85.11.167[.]52 as a C2 server; these are included as addresses only. Microsoft's hunting query writes 178.15.54[.]129 for 178.16.54[.]129: that address belongs to a consumer internet provider and is deliberately not included.