ARTEX-using actor expands targeting of IT and software vendors
Original title: ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
Wiz says an operator using the open-source ARTEX penetration-testing agent targeted IT and software vendors throughout October 2026. Activity focused on Okta, Entra ID, Cognito and Microsoft 365 integrations, including attempts to reach those vendors' customer data. Wiz says the infrastructure and patterns overlap Microsoft's Storm-0940 reporting and extend attempted supply-chain compromises into other software sectors. The developer closed ARTEX's source on October 8 after more than 12,000 forks.
Unconfirmed: Wiz ties the activity to Storm-0940 through overlap with Microsoft's report, not a new independent attribution.
- ARTEX had more than 12,000 GitHub forks before its source was closed on October 8.
- Password-spray bursts hit hundreds of users, with a median one-second gap between attempts.
- Some sessions lasted 24 to 30 hours and replaced blocked IP addresses within minutes.
- One session sent unsigned JWTs to more than 60 SSO route variations in two minutes.
Impact: Attempts to bypass authentication and access vendor customer data
- ATT&CK
- T1110.003 Password SprayingT1087 Account DiscoveryT1595 Active ScanningT1606 Forge Web Credentials
- Threat actors
- Storm-0940
- Malware
- ARTEX
- Organizations
- Zscaler
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 104.194.150.21 | be noisy if hunted independently. Type Indicator IP Address 104.194.150.21 IP Address 144.172.64.60 - Microsoft attributes to Storm-09 |
| ipv4 | 144.172.64.128 | 4.172.64.99 - Microsoft attributes to Storm-0940 IP Address 144.172.64.128 - Microsoft attributes to Storm-0940 IP Address 167.88.172. |
| ipv4 | 144.172.64.60 | dently. Type Indicator IP Address 104.194.150.21 IP Address 144.172.64.60 - Microsoft attributes to Storm-0940 IP Address 144.172.64. |
| ipv4 | 144.172.64.99 | 4.172.64.60 - Microsoft attributes to Storm-0940 IP Address 144.172.64.99 - Microsoft attributes to Storm-0940 IP Address 144.172.64. |
| ipv4 | 167.88.172.97 | .172.64.128 - Microsoft attributes to Storm-0940 IP Address 167.88.172.97 User Agent curl/7.88.1 User Agent Mozilla/5.0 (Windows NT 1 |
From the original article
7 min read at wiz.io
Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.
By Sapir Federovsky · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.