[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ87L8XjyAJwCgkydPf0ikaHgJQQh9zwmQsJyUT8iQG0":3},{"article":4,"iocs":56,"watch_terms":74,"solutions":75,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"38165c35-d027-40ed-8210-e9427ba90d24","ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors","artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors-50a659","Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.","Wiz Research identified a Chinese state-aligned actor (Storm-0940) using ARTEX, an autonomous AI penetration-testing agent, to attack multiple IT and software vendors including Okta, Entra, and Cognito throughout October 2026. The attacker employed a repeatable playbook involving reconnaissance of applications, probing authentication mechanisms, password spraying, account recovery abuse, and tenant isolation testing. The activity overlaps with Microsoft's recent reporting on Storm-0940 and represents an expansion of supply-chain compromise attempts across the software sector.","Storm-0940 uses ARTEX AI agent to target identity providers and IT vendors in October 2026.","https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fartex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors","https:\u002F\u002Fwww.datocms-assets.com\u002F75231\u002F1792671028-threat-update-blue-wireframe_custom.jpeg","2026-10-22T13:05:31+00:00","2026-10-23T15:08:57.486266+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Storm-0940","threat_actor",{"name":21,"type":22},"Okta","product",{"name":24,"type":22},"Entra ID",{"name":26,"type":22},"AWS Cognito",{"name":28,"type":29},"Microsoft","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,65,68,71],{"type":58,"value":59,"context":60},"malware","ARTEX","Autonomous AI penetration-testing agent; open-source tool published on GitHub in July 2026, weaponized by threat actors within weeks",{"type":62,"value":63,"context":64},"mitre_attack","T1592","Gathering victim org information - reconnaissance of application source maps and API documentation",{"type":62,"value":66,"context":67},"T1110","Brute force password spraying against Okta and Entra ID environments",{"type":62,"value":69,"context":70},"T1078","Valid accounts abuse through account recovery and reset-token endpoint exploitation",{"type":62,"value":72,"context":73},"T1550","Use of stolen or abused credentials for lateral movement and cross-tenant access",[28,21,24],{"controls":76,"vendors":156},[77,105,131],{"slug":78,"name":79,"problem":80,"products":81},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[82,89,97],{"vendor_slug":83,"vendor_name":28,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":106,"name":107,"problem":108,"products":109},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[110,118,123],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":83,"vendor_name":28,"vendor_logo":84,"product_slug":119,"product_name":120,"url":121,"description":122},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":55,"name":132,"problem":133,"products":134},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":152,"product_name":153,"url":154,"description":155},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[157,160,164],{"slug":83,"name":28,"logo_path":84,"roles":158},[159],"affected",{"slug":161,"name":21,"logo_path":162,"roles":163},"okta","\u002Fvendor-logos\u002Fokta.png",[159],{"slug":165,"name":166,"logo_path":167,"roles":168},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[169],"reported_by"]