Created 5 accounts. 3 enrolled in Okta Verify, and one of them completed 50 successful SSOs. Existing accounts were not compromised.
Targets
- The Okta tenant of one Expel customer (not named)
Attribution
- ARTEX basis
- Expel states that the shared IP is the only link, which is not enough to prove ARTEX was used.
- Actor
- Storm-0940 infrastructure.
- Same attacker?
- Based only on a shared IP. No ConnectWise application was involved.
Figures and definitions
| Scale | 5 accounts; 50 SSOs; 100+ tokens; all 21 sprays blocked |
|---|
Related events
Sources (1)
- 2026-10-21 Vendor Expel Storm-0940 ARTEX attacks: ConnectWise app abuse and Okta sign-ups