Threat feed

ARTEX Okta/Entra spray campaign

ARTEX/Storm-0940 identity campaign: AI agent sprays Okta, Entra and Cognito at software vendors

Posted · Updated · Spectrum Delta Research Team

Summary

Wiz Research (Oct 22, A/2) documents a month-long October 2026 campaign in which an ARTEX-using actor — overlapping Microsoft's Storm-0940 attribution — directly attacked identity infrastructure at multiple IT and software vendors: Okta, Entra ID, AWS Cognito and proprietary login flows. The autonomous AI agent ran a repeatable playbook — map the application from its own source maps, probe OAuth/SSO with fabricated codes and unsigned JWTs, abuse account recovery, test tenant isolation, and password-spray in machine-paced bursts — and Wiz states most attempts failed: sustained targeting, not a confirmed breach.

Breakdown

Adversary

An ARTEX-using actor overlapping Microsoft's Storm-0940

Procedures (5)

  1. Source-map recon then internal API calls by name

    Active scanning: application self-documentation recon

    • T1595.002Active Scanning: Vulnerability Scanning

    Logs

    • Web / HTTP access logs · Source-map and config requests; OAuth probes; cross-tenant 403/401s

    Detectors

    No known detector

Click to expand remaining (4) procedures

  1. OAuth/SSO probing with unsigned JWTs and fabricated codes

    Use of alternate authentication material (attempted): OAuth and SSO probing

    • T1550.001Use Alternate Authentication Material: Application Access Token

    Logs

    • Web / HTTP access logs · Source-map and config requests; OAuth probes; cross-tenant 403/401s

    Detectors

    No known detector

  2. Account-recovery endpoint and Cognito flow abuse

    Credential guessing via account-recovery abuse

    Logs

    • AWS Cognito events · InitiateAuth; ForgotPassword; ResendConfirmationCode; SignUp attempts
    • Web / HTTP access logs · Source-map and config requests; OAuth probes; cross-tenant 403/401s

    Detectors

    No known detector

  3. Disposable-email registration to test tenant isolation

    Exploit public-facing application (attempted): tenant-isolation testing

    • T1190Exploit Public-Facing Application

    Logs

    • Web / HTTP access logs · Source-map and config requests; OAuth probes; cross-tenant 403/401s

    Detectors

    • Unusual Mass Access Denied Activity · Mass 403/401 responses

  4. Machine-paced password spraying across Okta and Entra

    Password spraying: machine-paced, provider-agnostic, role-targeted

    Logs

    • Okta authentication logs · Bursty failed auths across many users; 1-sec gaps; per-burst user agents
    • Entra sign-in logs · Spray bursts against Entra ID; failed sign-ins across engineer accounts

    Detectors

    • Okta Users Password Spray · Spray bursts across Okta users
    • Potential Password Spray Attack From Single IP · Spray from single source IP

Indicators of compromise

Hunt only

(Wiz (https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors), A/2) — IPs 144.172.64.60, 144.172.64.99, 144.172.64.128 (Microsoft attributes to Storm-0940) and 104.194.150.21, 167.88.172.97 (listed by Wiz without that attribution); 15+ user agents observed across victims, including curl/7.88.1, Python-urllib/3.12, python-requests/2.34.2, truncated Chrome strings, headless-browser strings with random version numbers, the self-describing identifier ReconProbe/1.0, norma/0.4, and full Boto3 1.43.113/1.43.112 and aws-cli 1.46.1 strings — Wiz cautions many are not unique to this actor and are noisy hunted independently. AWS Cognito event markers: InitiateAuth, ForgotPassword, ResendConfirmationCode, SignUp. Assessed 2026-10-24, hunt-only — the IPs are perishable attacker infrastructure; the durable hunt value is the behavioral pattern (source-map-then-internal-API sequence, OAuth probing shapes, recovery-flow abuse, machine-paced multi-provider spray with per-burst user-agent discipline).

Detailed

IPs: 144.172.64.60, 144.172.64.99, 144.172.64.128 (Microsoft-attributed to Storm-0940); 104.194.150.21; 167.88.172.97 (Wiz-listed without stated Microsoft attribution). User agents (15+ observed; Wiz cautions many are not unique to this actor): curl/7.88.1; Python-urllib/3.12; python-requests/2.34.2; ReconProbe/1.0; norma/0.4; full Boto3 1.43.113 and 1.43.112 strings; aws-cli/1.46.1; assorted Mozilla/5.0 Chrome strings including truncated and headless-browser variants with seemingly random version numbers. AWS Cognito event markers: InitiateAuth, ForgotPassword, ResendConfirmationCode, SignUp. HTTP response markers: registration 201, confirmation 200, reset-token request 204, cross-tenant access 403, admin-role redirect 401. Timing markers: one-second median inter-attempt gap; 20-60 minute bursts; 24-30 hour sessions; 60+ SSO-route variations in two minutes; source-IP replacement within minutes of blocking. Campaign window: throughout October 2026. All from the primary (Wiz (https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors), A/2, Oct 22 2026), assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of ARTEX Okta/Entra spray campaign? Bring them to the community.

Discuss in the Tradecraft Slack