---
title: Hunt: the ARTEX AI agent tied to Storm-0940 is hitting software vendors' Okta, Entra and Cognito with source-map recon, alg:none JWTs and one-per-second password sprays | ctxsec
url: https://ctxsec.com/items/hunt-wiz-artex-storm-0940-idp-spray
description: ""
status: "vendor research (Wiz Research, Oct 22); overlaps Microsoft's Storm-0940 reporting"
published: 2026-10-22
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-wiz-artex-storm-0940-idp-spray.md)

vendor research (Wiz Research, Oct 22); overlaps Microsoft's Storm-0940 reporting

2026-10-22

### Hunt: the ARTEX AI agent tied to Storm-0940 is hitting software vendors' Okta, Entra and Cognito with source-map recon, alg:none JWTs and one-per-second password sprays

Wiz Research says an actor using **ARTEX**, an open-source autonomous pentest agent, spent October going after IT and software vendors, overlapping Microsoft's [Storm-0940](/context#ms-storm-0940-artex-agentic-ai) supply-chain report. Most attempts failed, but sessions ran 24 to 30 hours and new IPs showed up within minutes of a block.

1. **Recon:** requests for `*.js.map`, `/assets/config.json`, `/env.js`, `/swagger/?format=openapi`, then calls to internal API routes named only in those source maps. A baseline probe like `GET /zzz-nonexistent-xyz123` before fuzzing is a giveaway.
2. **Auth abuse:** OAuth callbacks with junk codes and malformed `state`; `/sso?jwt=` tokens with `{"alg":"none"}` sprayed across 60+ SSO route variants in two minutes.
3. **Account recovery and tenancy:** bursts of username validation and password-reset calls; sign-ups from disposable mailboxes followed at once by requests for another company's data. On Cognito, look for `SignUp`, `InitiateAuth`, `ForgotPassword` and `ResendConfirmationCode` from `boto` or `python-urllib` clients.
4. **Password spray (Okta and Entra):** 20 to 60 minute bursts at a median of exactly one attempt per second, a fresh user agent per burst, aimed mostly at software engineers.
5. **IOCs:** `104.194.150[.]21`, `167.88.172[.]97`, and `144.172.64[.]60`, `.99`, `.128` (the last three attributed to Storm-0940 by Microsoft). User agents include `ReconProbe/1.0` and `norma/0.4`; Wiz warns most of its other UAs are generic and noisy on their own.

Sources: [Wiz Research: ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors (Oct 22)](https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors) · [Microsoft Security Blog: Storm-0940 uses ARTEX agentic AI (Oct 21)](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)