Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Excerpt
In this article What’s happening What is ARTEX? Mitigation and protection guidance References Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure –…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 144.172.64.99 | Medium | Score 58/100 | First seen |
| IP | 187.15.89.186 | High | Score 58/100 | First seen |
| IP | 144.172.64.60 | High | Score 63/100 | First seen |
| IP | 187.15.90.217 | High | Score 58/100 | First seen |
| IP | 187.15.88.186 | High | Score 58/100 | First seen |
| IP | 144.172.64.128 | High | Score 87/100 | First seen |
IOC Relationship Graph
Building graph…