# ARTEX: Storm-0940's agent campaign widens to IT and software vendors

> Wiz tracked the ARTEX pentest agent beyond the ConnectWise breach, into password spraying and tenant probing at other software vendors.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Incident, Supply chain
- **Published by:** Wiz
- **Disclosed:** 2026-10-22
- **Affects:** Okta, Microsoft Entra ID, Amazon Cognito, Microsoft 365
- **Research by:** Sapir Federovsky (Wiz Research), Rami McCarthy (Wiz Research)
- **Primary source:** https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors
- **Page:** https://theinjection.dev/items/wiz-artex-storm-0940-vendor-campaign/

Wiz Research says an actor overlapping with Storm-0940 used the ARTEX agent framework against multiple IT and software vendors through October, password-spraying hundreds of Okta and Entra ID accounts, mostly software engineers.

## What happened

Wiz Research published its ARTEX tracking on October 22, 2026, written by Sapir Federovsky and Rami McCarthy. Wiz says it pivoted on the tooling and indicators in Microsoft's Storm-0940 report and found the same actor attacking multiple IT and software vendors through October 2026. Wiz describes the activity as overlapping with Storm-0940 rather than confirming the actor's identity.

## How it works

ARTEX is an open-source autonomous penetration-testing framework in which a planner agent directs worker agents that run tools such as nmap, curl and Impacket. The campaign followed a fixed playbook: pull JavaScript bundles, source maps and OpenAPI documents to map an application, replay sign-in flows, manipulate OAuth callbacks and state parameters, then test unsigned JWTs against SSO routes. One forged token with the algorithm set to none reached more than 60 SSO route variations in two minutes. Account-recovery and activation endpoints were called repeatedly, and registrations with disposable email addresses were used to probe predictable identifiers for cross-tenant access.

## Who is affected

Identity providers carried the brunt: Wiz observed attacks on Okta, Microsoft Entra ID and Amazon Cognito, plus abuse of Microsoft 365 integrations. Wiz does not name victims or give a count, and says the targets were IT and software vendors. Password spraying reached hundreds of users across Entra and Okta, with software engineers the main focus and some accounts taking more than a dozen login attempts.

## What to do

Hunt the indicators listed below in HTTP access logs and in Cognito, Entra and Okta identity logs, and enable password-spray and mass-access-denied detections. Wiz warns that several of the user agents it lists are not unique to this actor and will be noisy if hunted on their own, so pair them with the timing pattern: bursts of 20 to 60 minutes at about one request per second, with some sessions running 24 to 30 hours.

## Quick facts

- **Affected:** Okta, Microsoft Entra ID, Amazon Cognito, Microsoft 365 integrations
- **Attack type:** Autonomous agent reconnaissance, password spraying, tenant isolation probing
- **Tooling:** ARTEX, published July 2026, closed-sourced October 8 after 12,000-plus forks
- **Found by:** Wiz Research, from HTTP access logs and Cognito, Entra and Okta identity logs
- **Disclosed:** October 22, 2026
- **Attribution:** Wiz says overlapping with Storm-0940; Microsoft and Zscaler tie ARTEX to separate actors
- **Indicators:** IPs 104.194.150.21 and 167.88.172.97, plus three Storm-0940 IPs

## Questions

### Is this the same campaign as the ConnectWise breach Microsoft reported?

Wiz describes overlapping infrastructure, tooling and attack patterns with Microsoft's Storm-0940 report, but a broader target set across IT and software vendors rather than the single ConnectWise supply-chain compromise. Wiz says it pivoted on shared indicators to find the expansion, and stops short of independently confirming the actor's identity. Microsoft and Zscaler each tie ARTEX to separate actors.

### Which identity providers did the ARTEX campaign attack?

Okta, Microsoft Entra ID and Amazon Cognito all appear in Wiz's telemetry, alongside abuse of Microsoft 365 integrations. Wiz logged Cognito events including InitiateAuth, ForgotPassword and SignUp, and password spraying across both Entra and Okta that was not specific to one provider. Internal login pages were targeted as well as the providers' own endpoints.

### How can defenders tell this apart from ordinary password spraying?

Timing and breadth separate the two, according to Wiz. Bursts lasted 20 to 60 minutes with a median gap of one second between attempts, some sessions ran 24 to 30 hours, and each burst carried a unique user-agent string. Blocked addresses were replaced within minutes. Wiz also saw a dozen SSO endpoint variants cycled at roughly one request per second.

### Is ARTEX still available to attackers?

ARTEX was made closed-source on October 8, 2026, but Wiz reports the code already had more than 12,000 forks by then, so copies remain in circulation. A Chinese developer published the framework on GitHub in July 2026, and it won Baidu's Agent+ red team challenge in September. Wiz saw ARTEX artifacts against South Korean banks in late September and Japanese companies in October.

## Sources

1. [Wiz Research Post](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors)
2. [Microsoft Report](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)