Wiz Research says an actor using ARTEX, an open-source autonomous pentest agent, spent October going after IT and software vendors, overlapping Microsoft's Storm-0940 supply-chain report. Most attempts failed, but sessions ran 24 to 30 hours and new IPs showed up within minutes of a block.

1. Recon: requests for *.js.map, /assets/config.json, /env.js, /swagger/?format=openapi, then calls to internal API routes named only in those source maps. A baseline probe like GET /zzz-nonexistent-xyz123 before fuzzing is a giveaway.
2. Auth abuse: OAuth callbacks with junk codes and malformed state; /sso?jwt= tokens with {"alg":"none"} sprayed across 60+ SSO route variants in two minutes.
3. Account recovery and tenancy: bursts of username validation and password-reset calls; sign-ups from disposable mailboxes followed at once by requests for another company's data. On Cognito, look for SignUp, InitiateAuth, ForgotPassword and ResendConfirmationCode from boto or python-urllib clients.
4. Password spray (Okta and Entra): 20 to 60 minute bursts at a median of exactly one attempt per second, a fresh user agent per burst, aimed mostly at software engineers.
5. IOCs: 104.194.150[.]21, 167.88.172[.]97, and 144.172.64[.]60, .99, .128 (the last three attributed to Storm-0940 by Microsoft). User agents include ReconProbe/1.0 and norma/0.4; Wiz warns most of its other UAs are generic and noisy on their own.