Wiz Details ARTEX-Using Actor’s Automated Targeting of IT and Software Vendors

Oct 22, 2026 · Original article ↗

Summary

Wiz describes automated attacks against IT and software vendors that probed identity providers, Microsoft 365 integrations, and customer data. Most attempts failed; the activity used coordinated password spraying and adapted to blocked IPs and rate limits.

Key points

Wiz says it observed the activity across multiple environments, using HTTP access logs and AWS Cognito, Entra ID, and Okta identity logs.
The actor downloaded JavaScript source maps and API documentation, then used discovered routes to probe applications and account-recovery endpoints.
Attempts targeted OAuth and SSO flows, including fabricated callback parameters and unsigned JWTs, and probed AWS Cognito authentication and signup APIs.
Password spraying targeted hundreds of users, particularly software engineers, in coordinated bursts with roughly one-second intervals; some users faced more than a dozen attempts.
Sessions reportedly lasted up to 24–30 hours, with IP addresses changing after blocks and requests shifting to alternate endpoints when rate-limited.
Wiz says the activity overlaps with Microsoft reporting on Storm-0940, but describes its broader attribution as based on shared infrastructure, tooling, and patterns.
Wiz reports that most attempts failed and highlights existing login, password-spray, and mass-access-denied detection rules as ways to identify the activity.

Article Details

Attack Vectors: Mapped target applications by downloading JavaScript bundles, exposed source maps, runtime configuration files, and Swagger/OpenAPI documentation, then used discovered internal API routes.
Probed authentication flows by manipulating OAuth callback codes and state parameters, testing unsigned JWTs, and trying variations of SSO endpoints.
Conducted password-spraying bursts against Okta and Entra ID accounts, with a focus on software engineers.
Abused account-recovery and identity-provisioning endpoints, including password resets, username recovery, account activation, and AWS Cognito sign-up.
Registered accounts with disposable email addresses and tested for broken tenant isolation and unauthorized access to other customers’ data.
Changed IP addresses after blocks and varied user-agent strings; the article reports that most attempts failed.
Defensive Notes: Wiz recommends shortening the gap between exposure and remediation as reconnaissance and exploitation attempts scale.
The article says existing detection rules can identify patterns including repeated failed logins across multiple users followed by a successful admin login, password spraying, and unusual mass access-denied activity.
Review identity-provider and HTTP access logs for coordinated login bursts, repeated account-recovery requests, rapid endpoint variation, and API access following source-map downloads.

Indicators of compromise

Type	Indicator	Context
IPV4	`104[.]194[.]150[.]21`	Listed by Wiz as an IP indicator associated with the observed attack activity.
IPV4	`144[.]172[.]64[.]128`	Listed as an indicator; Microsoft attributes this IP to Storm-0940.
IPV4	`144[.]172[.]64[.]60`	Listed as an indicator; Microsoft attributes this IP to Storm-0940.
IPV4	`144[.]172[.]64[.]99`	Listed as an indicator; Microsoft attributes this IP to Storm-0940.
IPV4	`167[.]88[.]172[.]97`	Listed by Wiz as an IP indicator associated with the observed attack activity.