Password spraying against Okta and Entra and attacks on internal login pages, with some sessions lasting 24 to 30 hours. Wiz says most attempts failed. GTIG reports intrusions and data theft.
Targets
- Multiple IT and software vendors (not named)
Attribution
- ARTEX basis
- Wiz is tracking an ARTEX-using actor.
- Actor
- Wiz: ARTEX-using actor, overlapping with Storm-0940. GTIG: UNC7228, overlapping with STORM-0940.
- Same attacker?
- overlaps, not identical.
Figures and definitions
| Start | Wiz blog: October; GTIG relay: at least August |
|---|
Related events
Sources (2)
- 2026-10-22 Vendor Wiz Research ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
- 2026-10-22 Vendor Wiz Research ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors