ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

Storm-0940, a Chinese-state aligned threat actor, deployed ARTEX, an autonomous AI penetration-testing agent, in October 2026 to conduct targeted attacks against IT and software vendors. The focus was on identity providers including Okta, Entra, and Cognito. The attack methodologies observed involved detailed application mapping through JavaScript bundles and source maps, probing and manipulating authentication flows such as OAuth callbacks, password spraying in corporate environments, abusing account recovery mechanisms, and testing tenant isolation controls. The agent operated in sessions lasting 24 to 30 hours, automatically rotating IP addresses when blocked, and demonstrated agentic behavior with automated chaining of attack steps, adapting outputs, and persistent iteration. Attacks were characterized by coordinated bursts with unique user agents and one-second intervals between attempts, targeting software engineers across hundreds of users. This activity represents an evolution in autonomous AI-driven penetration testing used by a state-aligned actor in supply-chain attack contexts.

The use of an autonomous AI agent to conduct prolonged and adaptive attacks against identity providers and software vendors increases the risk of successful credential compromise, unauthorized access, and potential supply-chain compromises. The targeting of identity providers like Okta, Entra, and Cognito could enable attackers to bypass authentication controls and escalate privileges. The automated IP rotation and rapid, coordinated attack bursts complicate detection and mitigation efforts. The focus on software engineers and corporate environments suggests potential for significant operational and security impacts if successful.

No specific patch or remediation is indicated for this threat as it involves attacker behavior rather than a software vulnerability. Organizations should review and strengthen identity provider configurations, monitor for unusual authentication activity such as rapid password spraying or OAuth callback manipulations, and enforce strong multi-factor authentication. Monitoring for abuse of account recovery endpoints and tenant isolation testing attempts is advised. Given the autonomous and adaptive nature of the attacks, enhanced detection capabilities and incident response readiness are recommended. There is no vendor advisory or official fix applicable to this threat. Patch status is not applicable.