Skip to content

Translation in progress Some entries still include text in the original language.

EventPast event

Wiz tracks Storm-0940 using an AI Agent to attack software vendors

1 reports1 reporting sourcesLatest report

Start here

AI overview

Wiz Research reported that in October 2026 it observed attackers using the open-source autonomous penetration-testing Agent ARTEX to attack multiple IT and software vendors, focusing on identity providers such as Okta, Entra and Cognito and on Microsoft 365 integrations. The activity overlaps with Storm-0940, which Microsoft reported (described as an organization aligned with the Chinese state), and Wiz also observed the same actor extending supply chain attack attempts into other software sectors. ARTEX was released by a Chinese developer in July 2026.

Generated by AI from reports · Updated 8 days ago

Latest update
ARTEX in real-world operations: Storm-0940 expands attack targets to IT and software vendors

Progress timeline

Oct 24
  1. X@juliusnebah· Discussion
    The Executive Perspective On 21 October, Microsoft reported that a China-aligned hacking group it calls Storm-0940 use…(opens the original post in a new tab)
  2. X@masafumi_iwa· Discussion
    Microsoft officially announced. It stated explicitly that a series of attacks on the company came from a group linked to the Chinese state. Well, well… https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-use…(opens the original post in a new tab)
  3. X@grok· Discussion
    検知されたからレベルが低いとは限りません。Microsoftはクラウドのログやテレメトリで大規模な動きを把握しています。Storm-0940がオープンソースのAIエージェントARTEXを使い、1分に2900回のログイン試行や3時間以内の特…(opens the original post in a new tab)
  4. X@RIT_yasutake· Discussion
    Content (Microsoft Security Blog, October 21; Kyodo News): - Attacker: Storm-0940. Microsoft identifies it as an attacker associated with the Chinese government. From around September 2026, an open-source AI penetration-testing tool "…(opens the original post in a new tab)
  5. X@RIT_yasutake· Discussion
    From first targeting to obtaining privileged access on the cloud: less than 3 hours. Microsoft's October 21 (US time) publication of an attacker case using the AI intrusion testing tool "ARTEX." This is the shortest end across multiple cases, not an average. The image is, M...(opens the original post in a new tab)
  6. X@tetumemo· Discussion
    Storm-0940 uses ARTEX agentic AI, ConnectWise supply chain compromise（Microsoft Security Blog） https://www.microsoft.co…(opens the original post in a new tab)
  7. X@Qualiteg_global· Discussion
    Microsoft Security Blog, Oct 21: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic…(opens the original post in a new tab)
  8. X@norachan108· Discussion
    🚨 A Chinese government-linked hacker group uses AI as a weapon in worldwide cyberattacks! "Storm-0940," confirmed by US Microsoft. Who exactly are they? ■ Who Storm-0940 is: A cyberattack group pointed to as having ties to the Chinese government. ✅ 202…(opens the original post in a new tab)
  9. X@V0iD_0daY· Discussion
    Storm-0940 used ARTEX, an open-source agentic AI pentest tool, to aim stolen ConnectWise app creds at 2,250+ M365 tenan…(opens the original post in a new tab)
  10. X@GNT_fr· Discussion
    Une attaque par IA a ciblé des milliers d'environnements Microsoft 365 https://www.generation-nt.com/actualites/cyberat…(opens the original post in a new tab)
Oct 23
  1. X@metodo_viral· Discussion
    Menos de 3 horas entre escolher o alvo e ter acesso privilegiado. Segundo a Microsoft, o grupo chinês Storm-0940 usou a…(opens the original post in a new tab)
  2. X@turningpointjpn· Discussion
    A hacker group said to be linked to the Chinese government had launched AI-automated attacks on hundreds of organizations worldwide. → Microsoft announced this on the 21st. → The group is called "Storm-0940." It is said to have been active since 2021. → What it used was an AI-equipped…(opens the original post in a new tab)
  3. X@TheEastFrontier· Discussion
    Compromised ConnectWise app identities enabled Storm-0940 to target over 2,250 Microsoft 365 tenants, sustaining volume…(opens the original post in a new tab)
  4. X@winzheng_lab· Discussion
    Storm-0940 used AI to breach 2,250 Microsoft 365 tenants — full privilege access in under 3 hours Chinese hackers wea…(opens the original post in a new tab)
  5. X@hazemomier· Discussion
    Microsoft: Storm-0940 شغّل ARTEX، framework فيه agents بتعمل pentest لوحدها، على مئات الـ orgs، ووصل أحيانًا لـ privile…(opens the original post in a new tab)
  6. X@tpmbiosfidorss· Discussion
    A Microsoft 365 backup service became an entry point for attack. A Microsoft investigation has revealed the full picture of how China-linked Storm-0940 used an AI tool, "ARTEX," to attempt authentication against more than 2,250 tenants. https://joho-t…(opens the original post in a new tab)
  7. X@memolithapp· Discussion
    A Microsoft investigation has found that a hacker group linked to the Chinese government, "Storm-0940," abused an AI autonomous penetration-testing tool, "ARTEX," to launch cyberattacks on hundreds of organizations around the world. About 20 Japanese companies were reportedly also targeted…(opens the original post in a new tab)
  8. X@dariofernandez· Discussion
    Update: Microsoft says attackers used an AI tool and a hacked backup app to try 2,250+ Microsoft 365 tenants, sometimes…(opens the original post in a new tab)
  9. X@dorodango02· Discussion
    So that means it was a war started by China https://gigazine.net/news/20261023-storm-0940-artex-cyber-attack/(opens the original post in a new tab)
  10. X@Irving75038· Discussion
    "On October 21 (local time), Microsoft announced that the China state-linked attacker 'Storm-0940' is automating attacks with an AI agent-powered penetration testing framework 'ARTEX,' targeting hundreds of organizations worldwide. The company, on October…(opens the original post in a new tab)
  11. X@hmn_sm· Discussion
    When it's state-led, the deliverables probably include training data (attack records) too. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromi…(opens the original post in a new tab)
  12. X@urgenticaicyber· Discussion
    Microsoft: Storm-0940 used the ARTEX AI framework to target 2,250+ M365 tenants via the ConnectWise compromise. MSPs:…(opens the original post in a new tab)
  13. X@djony_sd· Discussion
    FIRST LAZARUS, NOW STORM-0940: AI AGENTS ARE WEAPONISED, AND THE CLOCK RUNS IN HOURS. Yesterday we covered Operation F…(opens the original post in a new tab)
  14. X@Dutchitchannel· Discussion
    Storm-0940 gebruikt agentisch AI-framework ARTEX voor grootschalige cloudinbraak: Onderzoekers van Microsoft Security R…(opens the original post in a new tab)
  15. X@tetumemo· Discussion
    📝 There is a case where an attack was automated with an AI agent, and privileged access was obtained in less than 3 hours after targeting Microsoft's security blog says: An attack group said to be state-linked in China, "Storm-0940," used an AI agent called ARTEX…(opens the original post in a new tab)
  16. X@JakubStupka· Discussion
    @silenej_ajtak Co se týká dalšího, čínská skupina Storm 0940 si hrála s Artex.: https://www.linkedin.com/safety/go/?u…(opens the original post in a new tab)
  17. X@shigishihara· Discussion
    >Storm-0940 is a group tied to the Chinese government and has been active since 2021. It has attacked many industries for the purpose of data theft. In attacks using ARTEX by Storm-0940, attackers gained privileged access to organizations' cloud infrastructure, and most…(opens the original post in a new tab)
  18. X@cc_lab_jp· Discussion
    According to Microsoft, the China state-linked attacker Storm-0940 automated attacks with the AI agent-based penetration testing framework ARTEX and targeted hundreds of organizations. Most failed, but there was also a case that reached privileged access in less than 3 hours from targeting…(opens the original post in a new tab)
  19. X@JunoAgent· Discussion
    Attackers run agents too. Microsoft says Storm-0940 used ARTEX, an open-source multi-agent pen-test framework, and stol…(opens the original post in a new tab)
  20. X@DFIR_Radar· Discussion
    Source: https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors(opens the original post in a new tab)
  21. X@DFIR_Radar· Discussion
    Storm-0940 is deploying ARTEX, a Chinese-developed autonomous AI pentesting agent, against IT and software vendors thro…(opens the original post in a new tab)
  22. X@ohmohm· Discussion
    Microsoft ชี้ Storm-0940 กลุ่มที่สอดคล้องกับรัฐจีน อยู่เบื้องหลังเหตุ ConnectWise — ใช้เอเจนต์ ARTEX พยายามล็อกอินกว่า…(opens the original post in a new tab)
  23. X@FranceNews24· Discussion
    🔴 INFO - #Cybersecurité 🌐 Le groupe de hackers Storm-0940, lié à la Chine 🇨🇳, mènerait une vaste campagne de cyberattaq…(opens the original post in a new tab)
  24. X@ai_topica· Discussion
    Intrusions left to AI. Trialed on 2250 organizations. Chinese attackers automate intrusions with AI, unauthorized sign-ins to 2250 organizations via ConnectWise https://onetrace.lyn-company.jp/ai-topica/articles/art…(opens the original post in a new tab)
  25. X@HLakadawala· Discussion
    4. Microsoft says China-aligned Storm-0940 used the ARTEX agentic fw against 100s of orgs. https://www.microsoft.com/e…(opens the original post in a new tab)
  26. X@wanco35323601· Discussion
    Did they go and launch a surprise attack⁉ The country in the middle... Why not immediately have AI counterattack, everyone in the world 💦😰‼ It's legitimate self-defense‼ Against exclusionary egoistic hackers ㊗😳💦 💢😳😰💦‼ Chinese government-linked hackers "Storm-0940" abuse AI to intrude, gaining connection privileges in 3 hours…(opens the original post in a new tab)
  27. X@jpntea001· Discussion
    Cyberattacks by a hacker group linked to the Chinese government. This is already war. Attacks are being carried out at 2,900 times per minute, a speed utterly impossible for humans. Microsoft [reported on] the hacker group "Storm-094…" which has been pointed to as linked to the Chinese state…(opens the original post in a new tab)
  28. X@Kuri2GT· Discussion
    The hacking happening around the world was China after all 💢 GMO has also announced it was attacked with Chinese-made AI ＊If they're being leisurely about "considering countermeasures," infrastructure and the Self-Defense Forces will have their functions stopped 💀 > Chinese government-linked hacker group "Storm-0940" used the Chinese-made AI "ARTEX"…(opens the original post in a new tab)
  29. X@t_nihonmatsu· Discussion
    @xysu2815 Exactly. Regarding Storm-0940, which was taken up on the Sanae Takaichi channel, in 2026 the automation of attacks exploiting the AI agent "ARTEX" has been confirmed. From home IoT devices to the cloud and AI, digital… across society as a whole(opens the original post in a new tab)
  30. X@atwight0201· Discussion
    ARTEX, as expected. I learned about it myself through the intrusion into South Korean financial institutions, and I thought it was only a matter of time. I think the same applies to intrusions into securities firms. I am genuinely concerned about what will happen when it reaches the core of finance. https://gigazine.net/news/20261023…(opens the original post in a new tab)
  31. X@newsnews_today· Discussion
    The China government-linked hacker group "Storm-0940" used the Chinese AI tool "ARTEX" to carry out cyberattacks targeting hundreds of companies and other entities around the world. Microsoft points out that this group is a "China government-linked attacker." Aerospace, military, automotive, finan…(opens the original post in a new tab)
  32. X@himaarihimawari· Discussion
    @sato_kei_nara @Sankei_news > The hacker group "Storm-0940," which is connected to the Chinese government. Sankei Shimbun uses the somewhat vague expression "connected to the Chinese government," but Microsoft describes Storm-0940 as a C…(opens the original post in a new tab)
  33. X@hiroki_miyano27· Discussion
    Less than 3 hours from target selection to seizing administrator privileges. The era in which AI agents play the leading role in attacks has become a reality. ・On October 21, 2026, Microsoft Corporation stated that the China government-linked hacker group "Storm-0940" used the Chinese AI tool "A…(opens the original post in a new tab)
  34. X@Wernher1912· Discussion
    AI is also being used for cyberattack defense, but the attacking side is considered overwhelmingly advantaged, and the current situation is that there is no silver bullet for companies, government agencies, individuals, and others. According to MS, this hacker group is "Storm-0940." At least since around September, publicly available AI intrusion…(opens the original post in a new tab)
  35. X@SecurityZ9999· Discussion
    State attribution for the ConnectWise compromise — Microsoft discloses "Storm-0940 + ARTEX," a single line connecting South Korea and Japan | Z Security @SecurityZ9999 https://note.com/zsecurity…(opens the original post in a new tab)
  36. X@nxf_owl· Discussion
    Threat actor believed to be state-sponsored: Storm-0940 appears to have been confirmed to be using ARTEX to automate attacks. https://www.microsoft.com/en-us/security/blog/2026/10/…(opens the original post in a new tab)
  37. X@crx7601· Discussion
    Chinese government-linked hacker group begins cyberattacks targeting the world; Chinese government: "We oppose slander and attacks using cyber issues as a pretext" ■What has been revealed ・The actor is a group called "Storm-0940" ・Since September, it has targeted hundreds of organizations worldwide ・Autonomous...(opens the original post in a new tab)
  38. X@Yabe_MiHiRo· Discussion
    Storm… ever since the days when BBSs were thriving, trolls have been disliked actors, haven't they σ(￣、￣=)ﾝｰﾄ https://gigazine.net/news/20261023-storm-0940-artex-cyber-attack/?utm_so…(opens the original post in a new tab)
  39. X@catcowbug· Discussion
    microsofts storm-0940 write-up leads with the ai agent framework (ARTEX). but the password spray from the same ip range…(opens the original post in a new tab)
  40. X@mwiwai· Discussion
    Microsoft announced that the hacker group "Storm-0940," said to be linked to the Chinese government, is using the hacking AI "ARTEX" to launch hacking attacks against hundreds of servers around the world. Hacking suffered by 16 South Korean financial institutions…(opens the original post in a new tab)
  41. X@ssomurice_local· Discussion
    [Storm-0940: The reality of a Chinese government-affiliated hacker group] Storm-0940 is a Chinese-affiliated cyberattack group active since at least 2021. Its main purpose is theft of confidential information, and in 2026 large-scale intrusion activity using AI was confirmed. US Mic…(opens the original post in a new tab)
  42. X@ssomurice_local· Discussion
    [Storm-0940: The reality of a Chinese government-affiliated hacker group] Storm-0940 is a Chinese-affiliated cyberattack group active since at least 2021. Its main purpose is theft of confidential information, and in 2026 large-scale intrusion activity using AI was confirmed. US Mic…(opens the original post in a new tab)
  43. X@s_hxxtn· Discussion
    🚨 Has the era of AI hackers really arrived? Humans are still writing code, and hackers have already started making AI launch attacks automatically! According to claims in the cybersecurity field, the China-linked hacker group Storm-0940 is alleged to have used an AI agent tool called ARTEX to try to turn cyberattacks into an automated pipeline. From…(opens the original post in a new tab)
  44. X@Awakend_Citizen· Discussion
    Less than 3 hours from being selected as a target to having cloud administrative privileges stolen. Microsoft disclosed AI abuse by the China-linked hacker group "Storm-0940." Since September, it has targeted hundreds of organizations worldwide in government, finance, aerospace, defense and other sectors, using the AI tool "AR…(opens the original post in a new tab)
  45. X@iam__jonny· Discussion
    [Into the era of autonomous AI agent attacks: Microsoft's latest report] Microsoft announced that the Chinese government-linked hacker group "Storm-0940" has been using autonomous AI tools to launch cyberattacks on hundreds of organizations worldwide. 📊 Attack overview…(opens the original post in a new tab)
  46. X@TweetThreatNews· Discussion
    Microsoft says China-aligned Storm-0940 used the ARTEX AI-agent framework to accelerate reconnaissance, password sprayi…(opens the original post in a new tab)
  47. X@Sankei_news· Discussion
    Chinese government-linked hacker "Storm-0940" abuses AI to intrude, seizes access credentials in 3 hours https://www.sankei.com/article/20261023-LRAZRG76VRJJ7DADYBQLYRPG7M/ US IT giant Micro...(opens the original post in a new tab)
  48. X@zakkas783· Discussion
    @fumokmm https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-c…(opens the original post in a new tab)
  49. X@t_nihonmatsu· Discussion
    [Chinese government-linked cyberattack] From the 2024 compromised router network covered on the Takaichi Channel to the 2026 large-scale attack by AI agents. On October 21, Microsoft said that the attack group "Storm-0940," which it assesses to be Chinese government-linked, used AI agents…(opens the original post in a new tab)
  50. X@innovaTopia_JP· Discussion
    Microsoft assessed the ConnectWise Cloud Backup compromise as the work of Storm-0940, which aligns with the Chinese state. With the AI tool "ARTEX," login attempts were made to over 2,250 tenants. On the customer side, malicious…(opens the original post in a new tab)
  51. X@Z3nlyte· Discussion
    Microsoft: Storm-0940 drove the open-source ARTEX agent framework against 2,250+ M365 tenants post-ConnectWise breach.…(opens the original post in a new tab)
  52. X@innovaTopia_JP· Discussion
    Microsoft assessed the ConnectWise Cloud Backup compromise as the work of Storm-0940, which aligns with the Chinese state. With the AI tool "ARTEX," login attempts were made to over 2,250 tenants. On the customer side, malicious…(opens the original post in a new tab)
  53. X@akira_papa_IT· Discussion
    [Approved apps as the entry point. Storm-0940's AI-accelerated attack] 🛡 Microsoft reported an incident in which credentials of approved apps were misused. Let's calmly organize the points to check. ■ 1. Overview of the report ▸ Micro…(opens the original post in a new tab)
  54. X@pw_ili· Discussion
    中国政府関係のハッカー、AI悪用 世界数百の組織へ、自動化サイバー攻撃 標的から権限を奪うのに3h未満 AIのスピードと規模を飛躍的に高める事例 マイクロソフトより、これら９月頃から、ARTEX(オープンソーステストフレームワーク)の悪用…(opens the original post in a new tab)
  55. X@SlashDigitalLab· Discussion
    The big AI story: @MsftSecIntel says China-aligned Storm-0940 used ARTEX, an agentic AI pentest framework, to reach 2,2…(opens the original post in a new tab)
  56. X@quinn_leng· Discussion
    5/ where AI is real: Microsoft says Storm-0940 ran an agentic framework (ARTEX) to spray passwords and abuse OAuth apps…(opens the original post in a new tab)
  57. X@stardust202201· Discussion
    China state-backed Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations worldwide across a wide range of industries. AI-accelerated follow-on activity includes reconnaissance, modification and expansion of application credentials, and…(opens the original post in a new tab)
  58. X@yousukezan· Discussion
    Microsoft analyzed that the attack group "Storm-0940," said to be China government-linked, was involved in the supply chain compromise of ConnectWise Cloud Backup. Using the AI penetration testing tool "ARTEX," in some cases in less than 3 hours from target selection…(opens the original post in a new tab)
  59. X@stardust202201· Discussion
    China government-linked hacker group "Storm-0940" has since around September been misusing the open-source AI penetration testing framework "ARTEX." It appears to be aimed at data theft.(opens the original post in a new tab)
  60. X@earlyfield2023· Discussion
    To put the conclusion first, this is not a story about "AI making attacks faster," but a story about "defenses that assume a human is in the loop no longer working." What Microsoft published on the 21st is that Storm-0940, said to be China-linked, used an open-source agentic penetration testing…(opens the original post in a new tab)
  61. X@info_yamakou· Discussion
    Even if you protect employees' passwords, the company can still be breached. The "spare key handed to the app" that the AI attack exploited. "Don't open suspicious emails." "Don't reuse passwords." "Set up multi-factor authentication." All of these are important measures. However, the attack using ARTEX this time is already…(opens the original post in a new tab)
  62. X@C5h2T1vp2gsH9uf· Discussion
    [10/23] Microsoft announced that the group "Storm-0940," which it assesses to be China state-linked, attacked hundreds of organizations worldwide with the AI tool ARTEX. Up to 2,900 login attempts per minute were observed. In some cases, cloud privileged access was obtained in under 3 hours. The group's [attacks] on Japanese companies…(opens the original post in a new tab)
  63. X@Beauty_And_Sou· Discussion
    [AI Fact-Check 2.0 | Verification result: TRUE ✅] Large-scale cyberattacks by Chinese hackers using AI — hundreds of organizations targeted, cloud privileged access obtained within 3 hours 📅 Verification date: October 23, 2026 📌 Subject: Sankei News (…(opens the original post in a new tab)
  64. X@aruntikaram· Discussion
    Microsoft: Storm-0940 used ARTEX, an open-source multi-agent pentest framework, to go from first targeting to privilege…(opens the original post in a new tab)
  65. X@alighanavatidev· Discussion
    مایکروسافت امروز رسماً اعلام کرد پشت حملهی ConnectWise گروه چینی Storm-0940 بوده 😬 ولی نکتهی ترسناک اینجاست: با یه فر…(opens the original post in a new tab)
  66. X@webtkdev· Discussion
    Agentic AI is now standard attacker tooling. Microsoft says state-aligned Storm-0940 used ARTEX, an agentic pentest fr…(opens the original post in a new tab)
  67. X@ikinokore_3k· Discussion
    The era has begun in which AI turns "defensive tools" into weapons and targets thousands of cloud environments at once at a speed beyond human limits. What Microsoft disclosed on October 21 is not just a cyberattack. The group assessed to be linked to the Chinese government, "St…"(opens the original post in a new tab)
  68. X@itsnextwork· Discussion
    Microsoft disclosed it on Oct 21. A China-aligned group, Storm-0940, used ARTEX, a free tool where AI agents run a whol…(opens the original post in a new tab)
  69. X@atakumi· Discussion
    @kureakurea01 An attack on Japan "as well." Be accurate with Japanese. According to the original article, it does not appear to have targeted a specific country. It just gives the impression that a state-linked organization that always targets global corporate data "tried to see how far it could go using AI," but it's quite interesting...(opens the original post in a new tab)
  70. X@vJ1CgVmtT71676· Discussion
    As expected, this is Chinese Communist Party cyberterrorism. It is not "racism" but fact, and the reality of state-sponsored intelligence activity. Japan should strengthen its vigilance toward China. According to what Microsoft confirmed and disclosed on October 21, the Chinese government-linked hacker group "Storm-0940" has A...(opens the original post in a new tab)
  71. X@AnotherCodingX· Discussion
    Microsoft says a China-aligned group it tracks as Storm-0940 used the ARTEX agentic AI penetration-testing framework in…(opens the original post in a new tab)
  72. X@kabutakkuchan· Discussion
    【Entering an era where AI autonomously creates backdoors: thoughts on the ConnectWise intrusion incident】 The cyberattack by Storm-0940, a Chinese government-linked hacker group, announced by Microsoft, is packed with 3 important elements that will change the premises of security going forward. ① Legitimate…(opens the original post in a new tab)
  73. X@cyb3rops· Discussion
    And as if all these critical vulnerabilities weren't enough, we've also had several reports about threat actors using A…(opens the original post in a new tab)
  74. X@vJ1CgVmtT71676· Discussion
    See, as expected, it's cyberterrorism by the Chinese Communist Party. This is not "racism" but fact, and the reality of state-sponsored intelligence activity. Japan should strengthen its vigilance toward China. According to what Microsoft confirmed and published on 21 October, the Chinese government-linked hacker group "Storm-094…(opens the original post in a new tab)
  75. X@jimmy_longbow_· Discussion
    An ARTEX-using actor attacked IT/software vendors in October, aiming at Okta, Entra and Cognito. Wiz says it overlaps M…(opens the original post in a new tab)
  76. X@stretchcloud· Discussion
    2,900 sign in attempts a minute. That is the pace Microsoft clocked from an AI agent, not a botnet, not a script kiddie…(opens the original post in a new tab)
  77. X@harden_369741· Discussion
    2,900 logins a minute. Not guessing. A workforce. Microsoft says China-aligned Storm-0940 used the AI framework ARTEX…(opens the original post in a new tab)
  78. X@Playhnuts· Discussion
    ⚠ Microsoft : un groupe lié à la Chine a utilisé un framework IA agentique pour automatiser des attaques via ConnectWi…(opens the original post in a new tab)
  79. X@Rico_s_gumi· Discussion
    マイクロソフトが自社のクラウドサービスの記録などを調べた。 「Storm（ストーム）-0940」と呼ぶハッカー集団が9月以降、ARTEXを使って世界中の数百の企業や...(opens the original post in a new tab)
  80. X@Hubris2050· Discussion
    @TechCrunch Per Microsoft, Storm-0940's ARTEX agents got privileged cloud access under 3 hours from targeting in multip…(opens the original post in a new tab)
  81. X@aviatrixtrc· Discussion
    Storm-0940 weaponized ARTEX AI agents to spray 2,900 password attempts per minute across 2,250+ Microsoft 365 tenants—a…(opens the original post in a new tab)
  82. X@Quincampoix_jp· Discussion
    Storm-0940 Hackers Use ARTEX AI to Automate Cloud Attacks and Establish Persistent Access https://cyberpress.org/storm-…(opens the original post in a new tab)
  83. X@aviatrixtrc· Discussion
    Storm-0940 self-assigned Global Administrator roles to compromised service principals across thousands of Microsoft 365…(opens the original post in a new tab)
  84. X@Leila97726926· Discussion
    APT Storm-0940, a Chinese aligned cyber actor that has been active since 2021, has used ARTEX AI to automate intrusions…(opens the original post in a new tab)
Oct 22
  1. Wiz Research
    ARTEX in real-world operations: Storm-0940 expands attack targets to IT and software vendors

    Wiz Research observed that in October 2026, attackers used the open-source autonomous penetration testing agent ARTEX to attack multiple IT and software vendors, focusing on identity providers such as Okta, Entra and Cognito and on Microsoft 365 integrations. The activity overlaps with Storm-0940 as reported by Microsoft (an organization aligned with the Chinese state's position), and Wiz also observed the same actor expanding supply chain attack attempts into other software areas. ARTEX is an open-source penetration testing framework released on GitHub by a Chinese developer in July 2026, and it had more than 12,000 forks before it switched to closed source on October 8. The attacks show reusable procedures, such as bombarding more than 60 SSO route variants with unsigned JWTs within two minutes, password spraying against hundreds of users (median interval between attempts 1 second), sessions lasting as long as 24-30 hours, and IP changes within minutes after an IP is blocked.

Related discussion

Total 117 items

Attention trend

New sources per day

108 in 9 days·most 78 (Oct 23)·today 0

  • Oct 22: 17 new sources (1 outlets, 16 accounts)
  • Oct 23: 78 new sources (0 outlets, 78 accounts)
  • Oct 24: 8 new sources (0 outlets, 8 accounts)
  • Oct 25: 2 new sources (0 outlets, 2 accounts)
  • Oct 26: 2 new sources (0 outlets, 2 accounts)
  • Oct 27: 1 new sources (0 outlets, 1 accounts)
  • Oct 28: 0 new sources (0 outlets, 0 accounts)
  • Oct 29: 0 new sources (0 outlets, 0 accounts)
  • Oct 30: 0 new sources (0 outlets, 0 accounts)

Hourly attention

Current attention 31·Peak in the comparable period 62 (Oct 23 13:00)·Change over the comparable past 24 hours -1%

020406080Oct 2313:00Oct 2516:00Oct 2718:00Oct 2921:00

Related events