Storm-0940 Broadens ARTEX Attacks to IT and Software Vendors

Summary

A China-aligned threat actor tracked as Storm-0940 is using ARTEX, an autonomous AI penetration-testing agent, to target IT and software vendors. The attacks focus on identity providers such as Okta, Entra, and Cognito to identify authentication weaknesses and gain access to customer data. The actor displays highly automated and adaptive behavior, including IP rotation and frequent user-agent changes to evade detection.

Investigation

Wiz Research identified the activity through analysis of HTTP access logs, identity provider telemetry from AWS Cognito, Entra, and Okta, and ARTEX-related artifacts. The investigation uncovered a repeatable playbook involving application mapping through source maps, authentication probing, and abuse of account recovery workflows. The campaign was linked to recent supply-chain activity and targeted multiple software sectors worldwide.

Mitigation

Defenders should enforce strong rate limiting on authentication and account recovery endpoints. Hardening identity provider configurations, particularly OAuth flows and JWT validation, is critical to reducing exposure. Organizations should also monitor for unusual spikes in access-denied events and recurring patterns associated with automated reconnaissance.

Response

When this activity is detected, security teams should immediately investigate failed login bursts and abnormal volumes of access-denied events. Correlate identity provider telemetry with web server logs to identify automated reconnaissance behavior. Apply rapid IP blocking where appropriate and monitor for follow-up attempts originating from new infrastructure or diverse user agents.

Add detection-focused response detailsClarify the campaign’s attack sequence

Simulation Execution

• Attack Narrative & Commands: The adversary is performing reconnaissance to map the target’s API surface. They begin by attempting to download the OpenAPI documentation (/swagger/?format=openapi) to identify hidden endpoints. To verify the robustness of the web server’s routing and to probe for potential “hidden” paths or configuration errors, the attacker immediately follows this with a request to a completely randomized, non-existent URI (/zzz-nonexistent-xyz123). This specific sequence is designed to match the behavioral fingerprint of the ARTEX campaign.

• Regression Test Script:

  #!/bin/bash
  # ARTEX Simulation Script
  # Target: Localhost Web Server
  
  TARGET_URL="http://localhost"
  
  echo "[+] Starting ARTEX Reconnaissance Simulation..."
  
  # Step 1: Trigger selection1 (Accessing Swagger documentation)
  echo "[+] Attempting to access OpenAPI documentation..."
  curl -s -o /dev/null -w "%{http_code}" "$TARGET_URL/swagger/?format=openapi"
  echo -e "n[+] Selection 1 triggered."
  
  # Step 2: Trigger selection4 (Probing non-existent resource)
  # This is the 'AND' condition required by the rule
  echo "[+] Probing for non-existent resource..."
  curl -s -o /dev/null -w "%{http_code}" "$TARGET_URL/zzz-nonexistent-xyz123"
  echo -e "n[+] Selection 4 triggered."
  
  echo "[+] Simulation complete. Check SIEM for detection."

• Cleanup Commands:

  # No persistent changes made by the simulation. 
  # If any files were created during testing, remove them:
  rm -f simulation_test_output.log