CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

UNC7228

actor · actor:unc7228

Google Threat Intelligence Group's designation for the ARTEX campaign that Wiz Research tracked, which GTIG says overlaps activity Microsoft tracks as Storm-0940 (GTIG, 2026-10-31).

Coverage
1
first 2026-10-22 → last 2026-11-01
Latest activity
2026-11-01
Microsoft: Storm-0940 runs ARTEX at machine speed; Mandiant now sees agent frameworks in incident-response…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
8
8 hosts

Action items (1)

Do-now tasks recorded on the entries about UNC7228, newest first. Check the date before acting on an older one.

Defender insights

What each entry about UNC7228 tells a defender to do, newest first.

2026-10-22NOTABLEMicrosoft: Storm-0940 runs ARTEX at machine speed; Mandiant now sees agent frameworks in incident-response cases

Exposure · triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

overlaps with

Story timeline

  1. 2026-10-22ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration
    active-threatsMicrosoft: Storm-0940 runs ARTEX at machine speed; Mandiant now sees agent frameworks in incident-response cases

Hunting pivots

Affected products
Microsoft Entra IDOkta
Tags
ai-abusechina-nexuscloudespionageidentitynation-state
ATT&CK techniques (13 across 8 tactics)

13 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceActive Scanning
  • Resource DevelopmentObtain Capabilities: Artificial Intelligence
  • Initial AccessValid Accounts · Valid Accounts: Cloud Accounts
  • PersistenceValid Accounts · Valid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles · Account Manipulation: Device Registration · Create Account: Cloud Account · Server Software Component: Web Shell
  • Privilege EscalationValid Accounts · Valid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles · Account Manipulation: Device Registration
  • StealthValid Accounts · Valid Accounts: Cloud Accounts
  • Credential AccessBrute Force: Password Spraying
  • DiscoveryAccount Discovery: Domain Account · Account Discovery: Cloud Account · Cloud Infrastructure Discovery

Reconnaissance TA0043

T1595Active Scanning×1

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Resource Development TA0042

T1588.007Obtain Capabilities: Artificial Intelligence×1

Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including creating scripts, assisting social engineering, developing payloads, and to Query Public AI Services in support of Reconnaissance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×1

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1136.003Create Account: Cloud Account×1

Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×1

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Credential Access TA0006

T1110.003Brute Force: Password Spraying×1

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Discovery TA0007

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1087.004Account Discovery: Cloud Account×1

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1580Cloud Infrastructure Discovery×1

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Entries about UNC7228 (1)

2026-10-22 · view entry permalink →

NOTABLEupdatedNATOB2

ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration

Microsoft Threat Intelligence reports that as early as September 2026 Storm-0940, a China-state aligned actor active since 2021, used the agentic penetration-testing framework ARTEX to automate attacks on hundreds of organizations across many industries, government and military among them (Microsoft, 2026-10-21). ARTEX is an open-source multi-agent LLM system that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human involvement (Microsoft, 2026-10-21). Microsoft says ARTEX accelerated the abuse of compromised applications already granted access to Microsoft 365 tenants (Microsoft, 2026-10-21), and Expel adds that it is not a vulnerability and only speeds up familiar techniques such as password spraying and OAuth-application abuse (Expel, 2026-10-21); most targeting failed, yet several cases went from first targeting to privileged cloud access in under three hours (Microsoft, 2026-10-21). Microsoft assesses the same actor was behind the ConnectWise Cloud Backup application-credential abuse (Microsoft, 2026-10-21).

Expel saw Storm-0940 infrastructure scan a customer and, from 2026-10-13, abuse its Okta self-service registration with no ConnectWise application involved: the attacker created five accounts of its own, enrolled Okta Verify on three of them about a minute after activation, made 50 single sign-on logins with more than 100 OAuth tokens issued and ran a password spray that Okta ThreatInsight blocked (Expel, 2026-10-21). Expel says the shared source address is its only link to Storm-0940, the activity alone does not prove ARTEX was used, and it had not seen the technique reported before (Expel, 2026-10-21). Other actors use it: CrowdStrike analysed an unnamed, probably Chinese-speaking and financially motivated actor that ran ARTEX against South Korean financial institutions from late September (CrowdStrike, 2026-10-07), and Recorded Future, which tracks that activity as TAG-217, says use of ARTEX and other AI penetration-testing tools is not limited to it (Recorded Future, 2026-10-16).

Wiz Research independently reports that throughout October 2026 it tracked an actor using ARTEX-associated tooling, overlapping with Storm-0940, against IT and software vendors, focused on identity providers (Okta, Entra, Cognito) and Microsoft 365 integrations, and says that most attempts failed and that none of the techniques is novel (Wiz, 2026-10-22). It describes a consistent sequence: downloading JavaScript bundles, exposed source maps, runtime configuration and OpenAPI documents, then calling internal API routes by name minutes later; fabricated authorization codes and malformed state values against Microsoft OAuth callbacks; unsigned JWTs tried against more than 60 SSO route variants in two minutes; and account-recovery, sign-up and Cognito calls such as InitiateAuth, ForgotPassword and ResendConfirmationCode (Wiz, 2026-10-22). Its password sprays against Entra and Okta hit hundreds of users, mainly software engineers, in bursts of 20 to 60 minutes with a unique user agent per burst, a median gap of one second between attempts and new source addresses within minutes of a block (Wiz, 2026-10-22).

Triage: Python and curl user agents match common legitimate automation, so Expel treats them as supporting evidence only, and a Python user agent on an application that normally calls Microsoft Graph with a .NET SDK is the anomaly (Expel, 2026-10-21).

used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries

including multiple instances where the time from initial targeting to privileged access was less than 3 hours

While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

Microsoft Threat Intelligence 2026-10-21

Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them

The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used.

ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse.

Expel 2026-10-21

the threat actor is likely a Chinese speaker and financially motivated

CrowdStrike Counter Adversary Operations 2026-10-07

Throughout October 2026, we identified an actor using tooling associated with ARTEX, an autonomous AI penetration-testing agent, to target multiple IT and software vendors.

Wiz Research 2026-10-22

In 38 of the incidents, the threat actor demanded ransom payments of 360 million won ($270,000), promising in exchange not to leak stolen data.

BleepingComputer 2026-10-26

Of the victim companies, 60 were counted as hacked using AI. (translated from Korean)

Yonhap News Agency 2026-10-26

Since late August 2026, we have observed threat actors actively operating popular open-source multi-agent pentesting platforms like ARTEX, PentAGI, CAIRN and other potentially custom harnesses within Mandiant incident response engagements

Although the original repository was taken down by its creator in October 2026 due to widespread threat actor abuse, the framework continues to proliferate globally via community forks

individual ARTEX execution sequences ran in compressed bursts of roughly 2 to 25 seconds

Google Threat Intelligence Group and Mandiant 2026-10-31
Improvementrun 2026-10-24T0255Z-intelbodyevidencesourcessourcing_note

Wiz Research reports an actor using ARTEX-associated tooling, overlapping with Storm-0940, against IT and software vendors throughout October 2026, focused on Okta, Entra and Cognito and on Microsoft 365 integrations, with most attempts failing (Wiz, 2026-10-22). It describes the log signatures of the agent: source-map and OpenAPI downloads followed minutes later by calls to internal routes that appear only in those files, fabricated OAuth callback values, unsigned JWTs tried against more than 60 SSO route variants in two minutes, account-recovery and sign-up calls, and password-spray bursts of 20 to 60 minutes against Entra and Okta with a unique user agent per burst and a median gap of one second between attempts (Wiz, 2026-10-22). Wiz says chaining, automatic adaptation to rate limits and blocks, and tests against heavily scrutinised Microsoft OAuth flows separate the agent from a human operator (Wiz, 2026-10-22).

Updaterun 2026-10-27T0256Z-intelevidencesourcessourcing_notesummary

Seoul Metropolitan Police announced on 2026-10-26 that it referred a 32-year-old gang leader to prosecutors on 2026-10-23, with six accomplices investigated without detention, for taking 8.2 million personal-data records and internal files from more than 90 organizations since September 2025, among them cram schools, hospitals, golf courses, universities and large-company affiliates, and for sending extortion e-mails (Yonhap, 2026-10-26, translated from Korean). BleepingComputer, citing local media, reports that the group demanded 360 million won (about USD 270,000) in 38 of the incidents in exchange for not leaking the data, that the police say the leader used the ARTEX framework, the same system used in the attacks on South Korean banks, and that he moved from conventional tools to AI utilities in late August 2026 (BleepingComputer, 2026-10-26). Yonhap counts 60 of the victims as hacked with AI and describes the system as the AI autonomous penetration-testing system used in the recent financial-sector data thefts without naming it, so the ARTEX name is BleepingComputer's (Yonhap, 2026-10-26). No encryption step is reported, and the police say AI lowered the barrier to entry and call this the first arrest in Korea in a large-scale hacking and personal-data theft case that exploited generative AI (BleepingComputer, 2026-10-26). The framework is therefore in use by a financially motivated criminal group as well as by the state-aligned actor Microsoft describes; no source reports a Swiss victim.

Updaterun 2026-11-01T0256Z-intelheadlinesummaryentitiestechniquessourcesevidencesourcing_note

Google Threat Intelligence Group (GTIG) and Mandiant report that since late August 2026 they have seen threat actors operate ARTEX, PentAGI, CAIRN and possibly custom harnesses inside Mandiant incident-response engagements, with agents carrying out significant parts of the attack lifecycle such as lateral movement, database exploitation and exfiltration preparation (GTIG and Mandiant, 2026-10-31). They say ARTEX has been adopted since late August by financially motivated extortion groups and suspected PRC-nexus clusters, whose operations affected organizations in government, technology, chemicals and materials, and manufacturing in the United States, and that the campaign Wiz tracks, which GTIG tracks as UNC7228, overlaps with Microsoft's Storm-0940 and dates back to at least August 2026 (GTIG and Mandiant, 2026-10-31). The original ARTEX repository was taken down by its creator in October because of abuse, but community forks, among them a commercial one, keep the framework in circulation (GTIG and Mandiant, 2026-10-31).

In several cases the operators handed ARTEX compromised credentials and told it to run the later stages. GTIG's log signature for the agent is execution in bursts of roughly 2 to 25 seconds, error-driven retries and forensically noisy trial and error; in one case, given valid credentials, the framework used an application's SQL API to point the MySQL general log at a web-accessible .jsp path and then ran SELECT statements carrying script tags, likely intended to write web shells under somewhat-incremental file names until they ran cleanly (GTIG and Mandiant, 2026-10-31).

Builds on: ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not…

threat22 Oct 03:45Zmulti-sourceOpen finding →
Sources: Microsoft Threat Intelligence · Expel · CrowdStrike Counter Adversary Operations · Recorded Future Insikt Group · Wiz Research · BleepingComputer · Yonhap News Agency · Google Threat Intelligence Group and Mandiant

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (12%)
  • cloud.google.com1 (12%)
  • crowdstrike.com1 (12%)
  • expel.com1 (12%)
  • microsoft.com1 (12%)
  • recordedfuture.com1 (12%)
  • wiz.io1 (12%)
  • yna.co.kr1 (12%)
All cited sources (8)