---
schema: 1
kind: threat
title: "ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration"
headline: "Microsoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique"
summary: >
  Microsoft reports that since at least September 2026 Storm-0940, a China-state aligned actor, has used ARTEX, an open-source
  multi-agent LLM penetration-testing framework, to automate scanning, password spraying and OAuth-application abuse against hundreds
  of organizations across many industries including government, reaching privileged cloud access in under three hours in several
  cases. Expel independently saw the same infrastructure create its own accounts through Okta self-service registration, enrol Okta
  Verify and sign in to applications, and CrowdStrike and Recorded Future document another actor using the same framework.
discovered_at: "2026-10-22T03:45:00Z"
updated_at: null
event_date: "2026-10-21"
run_id: 2026-10-22T0256Z-intel
priority: notable
immediate_action: null
tags: [nation-state, espionage, identity, cloud, ai-abuse, china-nexus]
regions: [global]
sectors: [public-sector]
entities: ["actor:storm-0940", "tool:artex", "incident:connectwise-cloud-backup-skykick-app-credential-abuse-2026-10", "product:microsoft-entra-id", "product:okta"]
techniques: [T1595, T1110.003, T1078.004, T1098.001, T1098.003, T1136.003, T1098.005, T1087.004, T1588.007]
affected_products: ["Microsoft Entra ID", "Okta"]
cves: []
sources:
  - url: "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/"
    publisher: "Microsoft Threat Intelligence"
    date: "2026-10-21"
    role: primary
  - url: "https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/"
    publisher: "Expel"
    date: "2026-10-21"
    role: corroborating
  - url: "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/"
    publisher: "CrowdStrike Counter Adversary Operations"
    date: "2026-10-07"
    role: corroborating
  - url: "https://www.recordedfuture.com/blog/tag-217-artex-south-korean-banks"
    publisher: "Recorded Future Insikt Group"
    date: "2026-10-16"
    role: corroborating
closed_sources: []
evidence:
  - quote: "used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries"
    publisher: "Microsoft Threat Intelligence"
    source_url: "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/"
  - quote: "including multiple instances where the time from initial targeting to privileged access was less than 3 hours"
    publisher: "Microsoft Threat Intelligence"
    source_url: "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/"
  - quote: "While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time."
    publisher: "Microsoft Threat Intelligence"
    source_url: "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/"
  - quote: "Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them"
    publisher: "Expel"
    source_url: "https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/"
  - quote: "The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used."
    publisher: "Expel"
    source_url: "https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/"
  - quote: "ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse."
    publisher: "Expel"
    source_url: "https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/"
  - quote: "the threat actor is likely a Chinese speaker and financially motivated"
    publisher: "CrowdStrike Counter Adversary Operations"
    source_url: "https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/"
verification: multi-source
sourcing_note: >
  The Storm-0940 attribution and the target list are Microsoft's assessment from its own telemetry; Expel relays Microsoft for the
  attribution and links its own Okta observation to Storm-0940 only through a shared source address. CrowdStrike and Recorded
  Future describe a different, financially motivated user of the same framework.
confidence: medium
references:
  - "2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse"
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "In every Okta org that allows self-service registration, review the accounts created since 2026-10-13 and every Okta Verify enrollment on them, and remove self-created accounts that nobody provisioned."
updates: []
migrated_from: null
---

Microsoft Threat Intelligence reports that as early as September 2026 Storm-0940, a China-state aligned actor active since 2021, used the agentic penetration-testing framework ARTEX to automate attacks on hundreds of organizations across many industries, government and military among them ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)). ARTEX is an open-source multi-agent LLM system that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human involvement ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)). Microsoft says ARTEX accelerated the abuse of compromised applications already granted access to Microsoft 365 tenants ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)), and Expel adds that it is not a vulnerability and only speeds up familiar techniques such as password spraying and OAuth-application abuse ([Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)); most targeting failed, yet several cases went from first targeting to privileged cloud access in under three hours ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)). Microsoft assesses the same actor was behind the ConnectWise Cloud Backup application-credential abuse ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)).

Expel saw Storm-0940 infrastructure scan a customer and, from 2026-10-13, abuse its Okta self-service registration with no ConnectWise application involved: the attacker created five accounts of its own, enrolled Okta Verify on three of them about a minute after activation, made 50 single sign-on logins with more than 100 OAuth tokens issued and ran a password spray that Okta ThreatInsight blocked ([Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)). Expel says the shared source address is its only link to Storm-0940, the activity alone does not prove ARTEX was used, and it had not seen the technique reported before ([Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)). Other actors use it: CrowdStrike analysed an unnamed, probably Chinese-speaking and financially motivated actor that ran ARTEX against South Korean financial institutions from late September ([CrowdStrike, 2026-10-07](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/)), and Recorded Future, which tracks that activity as TAG-217, says use of ARTEX and other AI penetration-testing tools is not limited to it ([Recorded Future, 2026-10-16](https://www.recordedfuture.com/blog/tag-217-artex-south-korean-banks)).

**Exposure:** any tenant that relies on password sign-in or grants OAuth consent to applications, and any Okta org with self-service registration enabled; not using ConnectWise does not exclude exposure ([Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)).

**Detection:** in the authentication logs of every identity provider in use, bursts of failed logons and lockouts spread over many accounts; in the Okta system log, newly self-registered accounts that enrol Okta Verify and start single sign-on within minutes; and in the Entra audit log, credentials or certificates added to applications that nobody on your team created and any application that assigns itself a directory role ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/); [Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)). A clean audit log is not proof of no access, because Microsoft Graph directory reads leave no Entra audit record ([Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)).

**Triage:** Python and curl user agents match common legitimate automation, so Expel treats them as supporting evidence only, and a Python user agent on an application that normally calls Microsoft Graph with a .NET SDK is the anomaly ([Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)).

**Defender takeaway:** Expel's reading is that the framework adds speed, not a new vulnerability, so the levers are the identity controls it runs into: least privilege on multi-tenant application permissions and consent grants, alerting on credential additions and privileged role assignments by applications, and a review of self-registered Okta accounts since 2026-10-13 ([Microsoft, 2026-10-21](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/); [Expel, 2026-10-21](https://expel.com/blog/storm-0940-artex-attacks-connectwise-app-abuse-and-okta-sign-ups/)).