ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

Summary

Wiz Research reports an actor using tooling tied to ARTEX, an open-source autonomous penetration-testing framework, to target IT and software vendors throughout October 2026. The activity focuses on identity providers (Okta, Entra, Cognito) and abuse of Microsoft 365 integrations, overlapping with Microsoft's report on Storm-0940, a Chinese state-aligned actor linked to a supply-chain attack involving stolen vendor credentials.

Related items

• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSame vendor · TechCrunch (Security)
• InfoBill Gates says to prepare for 20 years of ‘tumultuous’ AI disruptionSame vendor · The Verge (AI)
• MediumChina-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsSame vendor · CSO Online
• InfoAI firms say UK has a year to head off datacentre protests before construction is threatenedSame vendor · The Guardian Technology
• MediumChina-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain AttackSame vendor · The Hacker News