ARTEX in real-world operations: Storm-0940 expands attack targets to IT and software vendors

Wiz Research observed that in October 2026, attackers used the open-source autonomous penetration testing agent ARTEX to attack multiple IT and software vendors, focusing on identity providers such as Okta, Entra and Cognito and on Microsoft 365 integrations. The activity overlaps with Storm-0940 as reported by Microsoft (an organization aligned with the Chinese state's position), and Wiz also observed the same actor expanding supply chain attack attempts into other software areas. ARTEX is an open-source penetration testing framework released on GitHub by a Chinese developer in July 2026, and it had more than 12,000 forks before it switched to closed source on October 8. The attacks show reusable procedures, such as bombarding more than 60 SSO route variants with unsigned JWTs within two minutes, password spraying against hundreds of users (median interval between attempts 1 second), sessions lasting as long as 24-30 hours, and IP changes within minutes after an IP is blocked.