ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration
Microsoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique
Defender actions
- In every Okta org that allows self-service registration, review the accounts created since 2026-10-13 and every Okta Verify enrollment on them, and remove self-created accounts that nobody provisioned.
Analysis
Microsoft Threat Intelligence reports that as early as September 2026 Storm-0940, a China-state aligned actor active since 2021, used the agentic penetration-testing framework ARTEX to automate attacks on hundreds of organizations across many industries, government and military among them (Microsoft, 2026-10-21). ARTEX is an open-source multi-agent LLM system that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human involvement (Microsoft, 2026-10-21). Microsoft says ARTEX accelerated the abuse of compromised applications already granted access to Microsoft 365 tenants (Microsoft, 2026-10-21), and Expel adds that it is not a vulnerability and only speeds up familiar techniques such as password spraying and OAuth-application abuse (Expel, 2026-10-21); most targeting failed, yet several cases went from first targeting to privileged cloud access in under three hours (Microsoft, 2026-10-21). Microsoft assesses the same actor was behind the ConnectWise Cloud Backup application-credential abuse (Microsoft, 2026-10-21).
Expel saw Storm-0940 infrastructure scan a customer and, from 2026-10-13, abuse its Okta self-service registration with no ConnectWise application involved: the attacker created five accounts of its own, enrolled Okta Verify on three of them about a minute after activation, made 50 single sign-on logins with more than 100 OAuth tokens issued and ran a password spray that Okta ThreatInsight blocked (Expel, 2026-10-21). Expel says the shared source address is its only link to Storm-0940, the activity alone does not prove ARTEX was used, and it had not seen the technique reported before (Expel, 2026-10-21). Other actors use it: CrowdStrike analysed an unnamed, probably Chinese-speaking and financially motivated actor that ran ARTEX against South Korean financial institutions from late September (CrowdStrike, 2026-10-07), and Recorded Future, which tracks that activity as TAG-217, says use of ARTEX and other AI penetration-testing tools is not limited to it (Recorded Future, 2026-10-16).
Triage: Python and curl user agents match common legitimate automation, so Expel treats them as supporting evidence only, and a Python user agent on an application that normally calls Microsoft Graph with a .NET SDK is the anomaly (Expel, 2026-10-21).
Cited evidence
used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries
including multiple instances where the time from initial targeting to privileged access was less than 3 hours
While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.
Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them
The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used.
ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse.
the threat actor is likely a Chinese speaker and financially motivated
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.