{"slug": "artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors", "title": "ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors", "summary": "An actor using tooling tied to ARTEX, an open-source autonomous AI penetration-testing agent, targeted multiple IT and software vendors throughout October 2026, probing identity providers Okta, Entra and Cognito and abusing Microsoft 365 integrations to hunt for authentication bypasses, enumerate APIs and reach customer data, according to Wiz research that overlaps with Microsoft's report attributing the activity to the Chinese-state-aligned group Storm-0940. ARTEX was published on GitHub by a Chinese developer in July 2026, won Baidu's \"Agent+\" red team challenge that September, and had more than 12,000 forks before the developer made it closed-source on October 8, 2026, following attacks on South Korean banks in late September and Japanese companies in October. Wiz said it additionally observed the same infrastructure, tooling and attack patterns aimed at the sector as a whole and the actor expanding attempted supply-chain compromises into other software sectors.", "body_md": "Throughout October 2026, we identified an actor using tooling associated with ARTEX, an autonomous AI penetration-testing agent, to target multiple IT and software vendors. The activity focused on identity providers (Okta, Entra, Cognito) and abuse of Microsoft 365 integrations. We observed repeated attempts to uncover authentication bypasses, enumerate APIs, and access customer data (of the targeted vendors) across multiple environments.\n\nOur observations overlap with Microsoft's [recent report on Storm-0940](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/), a Chinese-state aligned actor - linked to the recent [supply-chain attack involving stolen vendor credentials and downstream Microsoft 365 tenants](https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access?hnt=xvnsv6u6opfh). \\\n\nHowever, we have additionally observed the same infrastructure, tooling, and attack patterns targeting the sector as a whole. Pivoting on identified TTPs and IOCs, we have also identified the same actor expanding their attempted supply chain compromises into other software sectors.\n\nIn this blog, we will describe the repeatable patterns and methodologies the ARTEX-using actor applied across multiple environments and cloud providers, with examples taken from real world attacks.\n\n**What is ARTEX?** \nARTEX is an open-source autonomous penetration testing framework. A Chinese developer published it on GitHub in July 2026, and it won Baidu's \"Agent+\" red team challenge that September. In practice, an operator supplies a target and an objective. A planner agent then chooses the next step, worker agents run tools like `nmap`, `curl`, and `Impacket`, and every result feeds a shared graph of assets and findings.\n\nAttackers picked it up within weeks. ARTEX artifacts surfaced in [attacks on South Korean banks](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) in late September and [attacks on Japanese companies in October](https://www.japantimes.co.jp/news/2026/10/20/japan/china-ai-cyberattacks/). [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) and [Zscaler](https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign) have since tied it to two separate actors. The developer [made the tool closed-source on October 8](https://www.reuters.com/world/china/chinese-developer-makes-artex-ai-agent-closed-source-after-korean-bank-hack-2026-10-09/). By then, the code had more than 12,000 forks.\n\n**A repeatable playbook**\nAcross the investigated environments, we observed a consistent sequence of reconnaissance and attack attempts:\n\n**Map the application:** Download JavaScript bundles, exposed source maps, runtime configurations, and Swagger/OpenAPI documentation to discover internal API routes and application functionality.\n**Probe authentication:** Repeatedly initiate sign-in flows, manipulate OAuth callbacks and state parameters, test unsigned JWTs, and probe SSO and Microsoft 365-specific endpoints.\n**Attack identity providers and login flows:** Password-spray corporate Okta and Entra ID environments, and target internal and proprietary application login pages.\n**Abuse account recovery:** Repeatedly invoke password-reset, username-recovery, activation, and reset-token endpoints.\n**Test tenant isolation:** Register accounts using disposable email addresses where possible, then manipulate predictable identifiers to probe for broken access controls and unauthorized cross-tenant data access.\n**Adapt to defense mechanisms:** Rotate IP addresses when blocked, and constantly circulate user agents.\n\n**What it looked like in the logs**\nWe analyzed these attack patterns using HTTP access logs collected via  [Wiz Agentless Workload Detection](https://www.wiz.io/blog/agentless-visibility-uncovering-cloud-blind-spots), alongside identity provider logs such as AWS Cognito events, Entra sign-in activity, and Okta authentication logs.\n\n#### Targeting Internal Applications\n\nThe agent's first move across all observed instances of the attack was always to read the application itself. Requests like these showed up minutes after first contact:\n\nNot long after, it started calling internal API routes by name. The only place those route names appear is in the source maps it had just downloaded.\n\nAccount recovery got the same treatment. The agent checked which usernames existed, then hammered the reset endpoints:\n\nWhere it could sign up, it did, using a throwaway mailbox from a free temporary-email service. Then, it immediately tried to look at someone else's data:\n\nBefore every fuzzing run, it checked what a baseline \"not found\" response looked like:\n\n#### **Targeting OAuth Identity Providers** \n\nWhen probing Microsoft OAuth flows, the agent directly manipulated the callback endpoint by injecting fabricated authorization codes and malformed state parameters, while also attempting to bypass authentication using unsigned JWTs:\n\nThat second token simply decodes to `{\"alg\":\"none\"}` and `{\"email\":\"test@test.com\"}`. The agent bombarded more than 60 variations of SSO routes with this payload in just two minutes.\n\nOn AWS Cognito, we observed patterns mirroring the account recovery abuse seen in proprietary apps. This activity was reflected in events like `InitiateAuth`, `ForgotPassword`, and `ResendConfirmationCode`. These requests originated from the same mix of user agents observed in earlier attacks, including benign-looking programmatic clients like `boto` and `python-urllib`.\n\nThe agent also attempted to provision new identities directly, invoking the AWS Cognito SignUp API while cycling through its pool of user agents.\n\n#### Password Spraying\n\nWe also tracked a massive password spray campaign across many of the observed targets. The activity was IDP-agnostic, hitting both Entra and Okta, and displayed several unique, AI-driven characteristics.\n\nThe attacks targeted hundreds of users and were executed in highly coordinated bursts. Each burst featured:\n\n**Dedicated user agents:** A unique user-agent string was assigned to each burst, distinct from those used in previous waves.\n**Precise timing:** The median gap between authentication attempts was strictly one second.\n**Sustained execution:** Individual bursts lasted anywhere from 20 to 60 minutes.\n**Role-based targeting:** The agent primarily focused on accounts belonging to software engineers.\n**Repeated attempts:** Some individual users were subjected to more than a dozen login attempts.\n\n**Relentless by Design**\n\nThe activity was persistent and highly automated. Some sessions lasted 24–30 hours, and when IPs were blocked, new addresses appeared within minutes.\n\nIn one session, the agent cycled through a dozen variations of the same SSO endpoint  (`/sso`, `/sso/`, `/sso/login`, `/sso/jwt`, `/jwt/sso…`), each with and without the same forged token, at a rate of about one request per second. When a login page started rate-limiting the activity, the agent simply switched to a different endpoint on the same host and carried on.\n\nWe observed more than 15 different user-agent strings across the victims:\n\n- Python-based clients and `curl` ;\n- Truncated Chrome strings and headless browsers with seemingly random version numbers.\n- More distinctive, self-describing identifiers, such as  `ReconProbe/1.0` .\n\nThis variety, combined with the consistent attack patterns and ARTEX-related indicators, helped us connect the activity across multiple organizations.\n\nAlthough most of these attempts failed, the true threat lies in the methodology. While a human attacker is bound by time constraints and fatigue, an autonomous agent does not give up. It simply continues to iterate until it finds a single weak point.\n\n**A clearly agentic attack**\nNone of the individual techniques observed are novel. However, together the agent behind this attack is illuminated. There are a few clear signals:\n\n**Steps were chained automatically** : when sign-up was open, it registered with a disposable mailbox, confirmed the account, and immediately requested another company's data.\n**Each automated step used the output of the last one** : internal API routes are called by name minutes after pulling the source maps\n**Adaptation was automatic** : when a login page started rate-limiting, the agent moved to a different endpoint on the same host. When an IP was blocked, a new one appeared within minutes.\n**Not all attacks were logical** : a human attacker of this skill level is unlikely to spend their time testing generic payloads on the heavily scrutinized Microsoft OAuth flows.\n\n**Staying Ahead of AI-Powered Attacks**\nAs AI makes reconnaissance and exploitation attempts faster and easier to scale, defenders need to shorten the gap between exposure and remediation. Learn more about how to prepare with Wiz's [AI Threat Readiness Framework](https://www.wiz.io/blog/ai-threat-readiness-framework). \n\nIn addition, [Wiz's AI Red Agent](https://www.wiz.io/solutions/red-agent) continuously and autonomously conducts offensive tests, helping reduce exposure at the speed of AI - evening the scales.\n\nWiz customers can refer to our Threat Intel Center Alert: [**ARTEX: Agentic AI Campaign Enables Cloud and Supply Chain Compromise**](https://app.wiz.io/boards/threat-center/wiz-adv-2026-192)\n\nExisting detection rules can also effectively identify this activity, for example:\n\n- Numerous Failed Login Attempts To Multiple Users Followed By A Successful Login To Admin User\n- Potential Password Spray Attack From Single IP\n- Okta Users Password Spray\n\nThe relentless behavior also creates predictable patterns that can also be detected by rules such as \"Unusual Mass Access Denied Activity.\"\n\n*Note: many of the provided user agents are not unique to this actor, and are expected to be noisy if hunted independently.* \n\n| Type | Indicator | \n|---|---|\n| IP Address | 104.194.150.21 | \n| IP Address | 144.172.64.60 - Microsoft attributes to Storm-0940 | \n| IP Address | 144.172.64.99 - Microsoft attributes to Storm-0940 | \n| IP Address | 144.172.64.128 - Microsoft attributes to Storm-0940 | \n| IP Address | 167.88.172.97 | \n| User Agent | curl/7.88.1 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0 Safari/537.36 | \n| User Agent | Python-urllib/3.12 | \n| User Agent | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124.0 Safari/537.36 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124.0 | \n| User Agent | Mozilla/5.0 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | \n| User Agent | python-requests/2.34.2 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0 Safari/537.36 | \n| User Agent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0 Safari/537.36 | \n| User Agent | norma/0.4 | \n| User Agent (Boto3 1.43.113) | Boto3/1.43.113 md/Botocore#1.43.113 ua/2.1 os/linux#6.8.0-147-generic md/arch#x86_64 lang/python#3.12.14 md/pyimpl#CPython m/e,b,Z,D cfg/retry-mode#legacy Botocore/1.43.113 | \n| User Agent (Boto3 1.43.112) | Boto3/1.43.112 md/Botocore#1.43.112 ua/2.1 os/linux#6.8.0-147-generic md/arch#x86_64 lang/python#3.12.14 md/pyimpl#CPython m/n,Z,b,D cfg/retry-mode#legacy Botocore/1.43.112 | \n| User Agent (aws-cli 1.46.1) | aws-cli/1.46.1 md/Botocore#1.43.62 ua/2.1 os/linux#6.8.0-147-generic md/arch#x86_64 lang/python#3.12.14 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy botocore/1.43.62 |", "url": "https://wpnews.pro/news/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors", "canonical_source": "https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors", "published_at": "2026-10-22 13:05:31+00:00", "updated_at": "2026-10-22 14:12:25.314702+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["ARTEX", "Storm-0940", "Microsoft", "Wiz", "Okta", "Entra", "Cognito", "Baidu"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors", "markdown": "https://wpnews.pro/news/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors.md", "text": "https://wpnews.pro/news/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors.txt", "jsonld": "https://wpnews.pro/news/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors.jsonld"}}