Wiz Details ARTEX AI Attack Activity Targeting Software Vendors and Entra ID

The attribution: overlap, not a blanket verdict​

Wiz says that as early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organizations globally. Microsoft also says it has identified threat actors across multiple geographic regions leveraging the ARTEX framework. So Storm-0940 is not the only user.

Wiz reports that its own observations overlap with Microsoft's. It saw the same infrastructure, tooling and patterns hitting other software vendors. It also describes attempted supply-chain compromises in other software sectors.

That is overlap, not proof that every incident Wiz describes was Storm-0940. Wiz's IP list marks three addresses as ones Microsoft attributes to Storm-0940. The other two Wiz indicators, 104.194.150.21 and 167.88.172.97, carry no such label.

What ARTEX is​

Wiz describes ARTEX as an open-source autonomous penetration-testing framework. The reported flow is:

• An operator supplies a target and an objective.
• A planner agent chooses the next step.
• Worker agents run tools such as nmap, curl and Impacket.
• Every result goes into a shared graph of assets and findings.

Microsoft's description fits this. It calls ARTEX an open source penetration-testing framework written in Go that uses AI agents to automate everything from reconnaissance and vulnerability discovery to credential attacks and data theft.

Wiz also gives some project history:

• A Chinese developer published the code on GitHub in July 2026.
• It won Baidu's "Agent+" red-team challenge in September.
• Artifacts appeared in attacks on South Korean banks in late September and on Japanese companies in October.
• The developer made the tool closed-source on October 8, after more than 12,000 forks.

These history details come from Wiz. Microsoft's report does not independently confirm all of them.

The playbook Wiz saw in the logs​

Wiz drew on HTTP access logs from its Agentless Workload Detection, plus Cognito events, Entra sign-in activity and Okta authentication logs. The agent worked through the same sequence in every environment.

1. Map the application. It pulled JavaScript source maps, runtime config files such as /assets/config.json and /env.js, and Swagger/OpenAPI documents. Minutes later it was calling internal API routes by name. Wiz notes those names appear only in the source maps it had just downloaded.
2. Probe authentication. It fed fabricated authorization codes and malformed state values into Microsoft OAuth callback endpoints. It also tried unsigned JWTs that declare the "none" algorithm. Wiz says it tried more than 60 SSO route variations with one such token in two minutes.
3. Abuse account recovery. It checked whether usernames existed, then hit password-reset, activation and reset-token endpoints repeatedly. On AWS Cognito this showed up as InitiateAuth, ForgotPassword and ResendConfirmationCode events, plus attempted SignUp calls.
4. Test tenant isolation. Where sign-up was open, it registered with a disposable email address and confirmed the account. It then tried to read another company's data. In Wiz's example, registration returned 201 and confirmation 200. The follow-up requests were refused with 403 and 401.
5. Spray passwords. It targeted Entra ID and Okta in bursts.
6. Adapt to blocking. When blocked, it rotated IPs and user agents. When rate-limited, it switched endpoints on the same host.

The 403 and 401 responses show the probing was denied in that sequence. They do not show data was retrieved. Wiz itself says most of these attempts failed.

The password-spray fingerprints​

Wiz describes the spray as hitting hundreds of users, mostly software engineers. Each burst had a few distinctive traits:

Wiz counted more than 15 user-agent strings across victims. They included Python clients, curl, truncated Chrome strings and headless browsers. One was the self-describing ReconProbe/1.0. Wiz warns that many of these strings are common and will be noisy if hunted on their own.

How Microsoft's numbers differ​

Wiz's telemetry and Microsoft's are separate datasets, and they should not be blended. Microsoft reports that Storm-0940 attempted sign-ins to more than 2,250 tenants. Its coverage figures show the pace reached 2,900 attempts per minute. For one spray from 144.172.64[.]99, between October 10 and 14, Microsoft counted 327 accounts across eight organizations. It recorded more than 151,000 failed logons and nearly 98% lockout responses. It saw no successful authentication, token issuance, Graph call or directory change in that particular campaign.

Microsoft also says stolen ConnectWise application credentials were used to reach customer environments. In some of them the agents moved on to Graph and directory operations. Those included reconnaissance, credential changes and privilege changes. Some incidents reached privileged cloud access in under three hours. Microsoft cautions that an affected app or a successful sign-in does not by itself prove data was accessed or stolen.

Microsoft also says the activity did not stem from a vulnerability in its own products or services. Independent coverage frames this as abuse of existing app trust, not a Microsoft flaw. One report notes that ConnectWise Cloud Backup, previously known as SkyKick, allows IT service providers to back up clients' Microsoft 365 data. Its apps hold broad access, which is what made their identities valuable.

Is "agentic" just a marketing word?​

Wiz is making a judgment call when it calls this attack agentic. It concedes that none of the individual techniques are novel. Its evidence is behavioral:

• Steps were chained, so each used the previous step's output.
• The adaptation was automatic.
• Some tests were illogical for a skilled human. Throwing generic payloads at heavily scrutinized Microsoft OAuth flows is an example.

That is reasonable inference, not proof. Wiz is also a vendor with an AI red-team product, and it promotes it at the end of the post. Take the "agentic" label as plausible and consistent with Microsoft's independent attribution. It is still an interpretation of log behavior.

The practical point holds either way. As The Register puts it, the underlying techniques are nothing new. Speed is the change, because it leaves defenders very little time to react.

What to do now​

For Microsoft 365 and Entra administrators, Microsoft's guidance covers the ConnectWise case.

• Keep affected ConnectWise application connections disabled until ConnectWise issues formal restoration instructions.
• Search by application ID, not display name, in every tenant where the apps are or were installed.
• Do not delete enterprise applications as the first response. Preserve configuration and evidence first.
• Review service-principal sign-ins from at least October 15, 2026. Extend that back to October 1 where records exist.
• Check Entra audit logs for credential additions, new owners, app-role assignments, consent grants, privileged role changes, and edits to authentication methods or Conditional Access.
• Check Microsoft 365 audit data for unusual mail or file access, forwarding or inbox rules, and delegated mailbox permissions.
• Let an authorized responder remove confirmed unauthorized credentials and grants only after evidence is preserved.

Microsoft warns that credential changes made by the agents can persist as a backdoor even after the original app is remediated. Cleaning up the app alone is therefore not enough.

For wider hardening, Wiz's findings point to these checks:

• Remove public source maps and debug config from production.
• Restrict Swagger/OpenAPI exposure.
• Reject unsigned JWTs.
• Rate-limit recovery and sign-up endpoints.
• Alert on mass access-denied patterns.
• Apply least privilege to multi-tenant app permissions.

Wiz says existing detections for password spray from one IP, failed logins across many users, Okta password spray and mass access-denied events can catch this activity.

Indicators​

Microsoft names 144.172.64[.]60, 144.172.64[.]99 and 144.172.64[.]128. Wiz adds 104.194.150.21 and 167.88.172.97. The shared user agents include curl/7.88.1, Python-urllib/3.12 and python-requests/2.34.2. Treat all of these as pivots for investigation. They are not proof of compromise or of attribution. Microsoft also notes that some of the IPs it lists were VPN addresses, so they are relevant mainly for activity around October 15 and 16.

The bottom line​

Wiz's report gives defenders a concrete, log-level picture of what an AI-driven intrusion looks like from the victim's side. It is persistent, fast and mostly unsuccessful, but it only has to succeed once. Microsoft's separate evidence shows that it did succeed at some organizations. If your tenant ever authorized ConnectWise Cloud Backup, start with the application ID search and service-principal sign-in review above.