ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

What it is

Wiz Research describes an actor overlapping with Storm-0940 that used tooling associated with ARTEX against IT and software vendors throughout October 2026. ARTEX is an open-source autonomous pentest framework published on GitHub by a Chinese developer in July 2026. It won Baidu's "Agent+" red team challenge in September 2026. A planner agent picks each step, worker agents run tools such as nmap, curl and Impacket, and results feed a shared graph of assets and findings. Wiz says the same infrastructure and patterns have also hit other software sectors, in attempted supply chain compromises.

How it works

The sequence was consistent across victims:

1. Recon: download JS bundles, exposed source maps, runtime configs and Swagger/OpenAPI docs. Internal API routes were then called by name within minutes, and those names appear only in the source maps.
2. Auth probing: fabricated OAuth codes and malformed state values, plus unsigned JWTs.
3. Account recovery abuse: username checks, then password-reset endpoints.
4. Tenant isolation tests: sign-up with disposable mailboxes, confirmation, then immediate requests for another company's data.
5. Password spraying against Okta and Entra.

Example requests from the logs:

GET /packs/js/main-3a9f...js.map
GET /assets/config.json
GET /env.js
GET /swagger/?format=openapi
GET /Account/ValidateUserName?UserName=admin
POST /api/v1/Users/GeneratePasswordResetToken → 204
POST /forgot_password
GET /zzz-nonexistent-xyz123
GET /sign_in/oauth/microsoft/callback?code=AAAA&state=notvalidb64!!
GET /sso?jwt=eyJhbGciOiJub25lIn0.eyJlbWFpbCI6InRlc3RAdGVzdC5jb20ifQ.

The JWT decodes to {"alg":"none"} and {"email":"test@test.com"}. More than 60 SSO route variations received it in two minutes. The /zzz-nonexistent-xyz123 request is a baseline "not found" check made before each fuzzing run.

On Cognito, Wiz saw InitiateAuth, ForgotPassword, ResendConfirmationCode and SignUp events, from user agents such as boto and python-urllib.

What to do

The page gives no remediation steps beyond a pointer to Wiz's AI Threat Readiness Framework. Its detection value is in these log signals:

• Spray bursts with a median gap of exactly one second between attempts, lasting 20 to 60 minutes, each with its own user-agent string.
• Spray targets weighted to software engineer accounts, hundreds of users, some with more than a dozen attempts.
• Sessions lasting 24 to 30 hours, with new IPs appearing within minutes of a block.
• More than 15 user agents across victims: Python clients, curl, truncated Chrome strings, headless browsers with random versions, and self-labelled ReconProbe/1.0.
• After rate limiting, a switch to another endpoint on the same host, such as /sso, /sso/, /sso/login, /sso/jwt, /jwt/sso, each with and without the same forged token, at about one request per second.
• Source map requests followed within minutes by calls to routes found only in those maps.
• Sign-up with a free temporary-email service, followed at once by cross-tenant data requests.

Wiz collected this from HTTP access logs (Agentless Workload Detection), Cognito events, Entra sign-in activity and Okta authentication logs. Checking source map exposure and unauthenticated Swagger on production is an inference from the recon pattern, not a stated recommendation.

Caveats

Wiz says most attempts failed and none of the techniques is novel. It attributes the actor by overlap with Storm-0940, not definitively. The page publishes no IOC list, and the attribution to agentic behavior rests on Wiz's own reading of the timing and chaining. User-agent strings and IPs rotate, so they are weak detection keys.