ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors

Wiz Research is tracking a threat actor overlapping with Storm-0940 that uses an AI-powered attack tool called ARTEX to target multiple software and IT vendors. The campaign focuses on identity providers and cloud authentication platforms including Okta, Microsoft Entra, and AWS Cognito. ARTEX functions as an AI agent capable of conducting automated attacks against identity and access management systems. The actor has expanded its targeting scope to include software vendors beyond its previously known victims. Forensic artifacts and log evidence were left behind during the intrusions, providing visibility into the attack methodology. This represents a notable escalation in the use of AI-assisted tooling by a state-linked threat actor in enterprise cloud environments.