/
← Voltar ao feed
high technology software it services

Storm-0940 actor uses ARTEX AI pentest agent against IT and software vendors' identity providers and M365 integrations

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 10:05 · coletado há 2 horas

Throughout October 2026, Wiz observed an actor using tooling associated with ARTEX, an open-source autonomous AI penetration-testing framework, against multiple IT and software vendors. The activity targeted identity providers (Okta, Entra ID, AWS Cognito) and Microsoft 365 integrations, with repeated attempts to bypass authentication, enumerate APIs and reach customer data. Wiz says the activity overlaps with Microsoft's reporting on Storm-0940, a Chinese-state aligned actor linked to a supply-chain attack involving stolen vendor credentials and downstream M365 tenants. Wiz also saw the same infrastructure and tooling used against the wider sector and expanded into other software sectors. Most attempts failed, but the persistent, adaptive automation is the main concern.

Detalhes técnicos

  • Tool background: ARTEX was published on GitHub in July 2026 by a Chinese developer and went closed-source on October 8 after more than 12,000 forks. ARTEX artifacts have also appeared in attacks on South Korean banks (late September) and Japanese companies (October). Microsoft and Zscaler tie it to two separate actors.
  • Reconnaissance: the agent downloaded JS bundles, source maps, /assets/config.json, /env.js and Swagger/OpenAPI docs, then called internal API routes by name minutes later.
  • Authentication probing: fabricated OAuth codes and malformed state parameters against Microsoft callback endpoints (/sign_in/oauth/microsoft/callback), and unsigned JWTs (alg:none, email [email protected]) sent to more than 60 SSO route variations in two minutes.
  • Account recovery abuse: username validation (/Account/ValidateUserName), password-reset token generation and /forgot_password. On Cognito, InitiateAuth, ForgotPassword, ResendConfirmationCode and SignUp events were seen.
  • Tenant isolation tests: sign-up with disposable email, account confirmation, then access to other companies' data (e.g. /company/1/logins, which returned 403) and role-manipulation attempts.
  • Password spraying: against Okta and Entra ID, in bursts of 20-60 minutes with one user agent per burst and a median one-second gap. It targeted hundreds of users, mainly software engineers, with some users hit more than a dozen times.
  • Evasion: IP rotation within minutes of blocks, more than 15 user-agent strings (Python clients, curl, truncated Chrome, headless browsers, ReconProbe/1.0, boto, python-urllib), switching endpoints when rate-limited, and sessions lasting 24-30 hours.
  • Many user agents are not unique to this actor and are noisy if hunted alone.

Remediação

  • Hunt for the patterns above in identity provider and HTTP logs: mass failed logins across users, password spray from single IPs, Okta password spray, and mass access-denied activity (Wiz cites existing rules for these).
  • Remove exposed source maps, runtime configs and API documentation from production, and harden OAuth/SSO callback handling, JWT validation (reject unsigned tokens), account-recovery endpoints and sign-up flows.
  • Apply rate limiting, and monitor for anomalous Cognito, Entra and Okta events.

Linha do tempo

  1. wiz.io ↗ · pub. 22/10/2026 10:05 · coletado 22/10 11:02 primeiro registro

    Storm-0940 actor uses ARTEX AI pentest agent against IT and software vendors' identity providers and M365 integrations

    ler a análise desta fonte

    Throughout October 2026, Wiz observed an actor using tooling associated with ARTEX, an open-source autonomous AI penetration-testing framework, against multiple IT and software vendors. The activity targeted identity providers (Okta, Entra ID, AWS Cognito) and Microsoft 365 integrations, with repeated attempts to bypass authentication, enumerate APIs and reach customer data. Wiz says the activity overlaps with Microsoft's reporting on Storm-0940, a Chinese-state aligned actor linked to a supply-chain attack involving stolen vendor credentials and downstream M365 tenants. Wiz also saw the same infrastructure and tooling used against the wider sector and expanded into other software sectors. Most attempts failed, but the persistent, adaptive automation is the main concern.

    Technical Details

    • Tool background: ARTEX was published on GitHub in July 2026 by a Chinese developer and went closed-source on October 8 after more than 12,000 forks. ARTEX artifacts have also appeared in attacks on South Korean banks (late September) and Japanese companies (October). Microsoft and Zscaler tie it to two separate actors.
    • Reconnaissance: the agent downloaded JS bundles, source maps, /assets/config.json, /env.js and Swagger/OpenAPI docs, then called internal API routes by name minutes later.
    • Authentication probing: fabricated OAuth codes and malformed state parameters against Microsoft callback endpoints (/sign_in/oauth/microsoft/callback), and unsigned JWTs (alg:none, email [email protected]) sent to more than 60 SSO route variations in two minutes.
    • Account recovery abuse: username validation (/Account/ValidateUserName), password-reset token generation and /forgot_password. On Cognito, InitiateAuth, ForgotPassword, ResendConfirmationCode and SignUp events were seen.
    • Tenant isolation tests: sign-up with disposable email, account confirmation, then access to other companies' data (e.g. /company/1/logins, which returned 403) and role-manipulation attempts.
    • Password spraying: against Okta and Entra ID, in bursts of 20-60 minutes with one user agent per burst and a median one-second gap. It targeted hundreds of users, mainly software engineers, with some users hit more than a dozen times.
    • Evasion: IP rotation within minutes of blocks, more than 15 user-agent strings (Python clients, curl, truncated Chrome, headless browsers, ReconProbe/1.0, boto, python-urllib), switching endpoints when rate-limited, and sessions lasting 24-30 hours.
    • Many user agents are not unique to this actor and are noisy if hunted alone.

    Remediation

    • Hunt for the patterns above in identity provider and HTTP logs: mass failed logins across users, password spray from single IPs, Okta password spray, and mass access-denied activity (Wiz cites existing rules for these).
    • Remove exposed source maps, runtime configs and API documentation from production, and harden OAuth/SSO callback handling, JWT validation (reject unsigned tokens), account-recovery endpoints and sign-up flows.
    • Apply rate limiting, and monitor for anomalous Cognito, Entra and Okta events.